Operation DragonReturn MixedSvc Service Creation via sc.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the creation, deletion, or starting of a Windows service named 'MixedSvc' via sc.exe. This activity is associated with the 'Operation DragonReturn' campaign, where adversaries leverage a service masquerading as legitimate Windows Media Player components to maintain persistence.