Analytics BIOC
Low
✕
Uncommon remote service start via sc.exe
The Service Control command (sc.exe) is used to create, start, stop, query, or delete Windows services. Adversaries may attempt to use the command to execute and persist a binary, command, or script.
- Module:
- Platform Analytics
- Data source:
- XDR Agent
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: System Services: Service Execution (T1569.002)
Detector tags: Malicious Service Analytics
Attacker's goals:
The Service Control command is used to create, start, stop, query, or delete Windows services. Attackers can use the command to attempt to execute and persist a binary, command, or script.
Investigative actions:
Check whether the executed process is benign and if this was desired behavior as part of its normal execution flow. Check the remote host for any evidence of the executed service and investigate it.
- Test period:
- N/A (single event)
- Deduplication:
- 1 Day