DcRAT MixedSvc Persistence via sc.exe in Windows Media Player Directory

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule detects the use of sc.exe to create or interact with Windows services related to 'Mixed Reality' components, such as 'MixedSvc' or 'Windows Mixed Reality Service'. This activity is often associated with the installation of persistence mechanisms or service-based execution by masquerading as legitimate Windows components.