sc.exe Child Process of ConfigurationRemotingServer.exe for Service-Based Persistence

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the ConfigurationRemotingServer.exe process spawning the Windows Service Control Manager (sc.exe). This pattern is often associated with the manipulation of Windows services, which can be an indicator of service-based persistence or command execution.