Operation DragonReturn MixedSvc Service Installation via sc.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•7

Detects the use of the Windows service control utility (sc.exe) to install or manage a malicious service named 'MixedSvc'. This activity, which involves pointing the service executable to 'Mixed Reality.exe' located in the Windows Media Player directory, is a persistence technique observed in Operation DragonReturn attributed to the Silver Fox threat group.