RageService malicious Windows service creation via sc.exe

Subhankar H@Andrewsec57

•updated Jul 6, 2026•0•0•2

Detects the creation of a Windows service named 'RageService' using the sc.exe utility, potentially involving associated binary names like 'RageCore_' or 'win_guard_'. This activity is indicative of persistence mechanisms used by malware or unauthorized tools.