Operation DragonReturn: DcRAT MixedSvc Persistence via sc.exe from Non-SCM Parent

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•9

This rule detects the use of 'sc.exe' to interact with services related to 'Mixed Reality' (a potential name masquerading technique) where the parent process is not the standard 'services.exe' or 'svchost.exe'. The rule also correlates this activity with the invocation of command interpreters like 'cmd.exe' or 'conhost.exe' by the parent process, which is highly indicative of malicious service manipulation or lateral movement.