Suspicious Driver Service Installation

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects attempts to install a suspicious driver service using the 'sc.exe' command. It has been observed that adversaries use this technique to install malicious/vulnerable drivers to bypass/disrupt security solutions such as EDRs. This technique is often used in conjunction with other techniques to establish persistence and maintain control over the compromised system.

2026-01-27 00:00:00

None

61268eb3-3eb0-4e74-a245-2b8cd7f5c583

attack.defense-evasion attack.t1562.001

Nextron Sigma feed only (private)