Malicious service masquerading as 'Microsoft Console Host' launching PowerShell

Duo Tech@duotech

•updated Jul 15, 2026•2•0•4

This rule detects two suspicious patterns: 1) Using the sc.exe utility to create a new Windows service configured to start at boot, often used for persistence or to execute malicious payloads with system privileges. 2) The execution of PowerShell.exe directly by the service control manager (services.exe), which is highly atypical for normal system operations and often indicates malicious script execution initiated as a service.