DcRAT MixedSvc Service Persistence via sc.exe in Windows Media Player Dir

Ibrahim Saud@tektrix

•updated Jun 27, 2026•0•0•1

This rule detects the execution of the Windows Service Control Manager tool (sc.exe) to interact with a service containing the string 'MixedSvc' and a reference to 'Mixed Reality.exe' in the command line. This behavior may indicate an attempt to manipulate or execute suspicious services using names that masquerade as legitimate Windows Mixed Reality components.