Security Product Service Tampering Via sc.exe

Tim Peck@timpeck

•updated Aug 28, 2025•6•0•141

Detects attempts to disable or modify common security products by reconfiguring their associated Windows service using the Service Control utility (sc.exe). This technique is frequently used by threat actors, including Sinobi ransomware, to evade defenses.