sc.exe
Summary
Service Control Manager command-line tool (sc.exe) is used to create, start, stop, query, and configure Windows services. It provides direct command-line access to the Service Control Manager and Windows service management APIs.
sc.exe is the 12th most commonly executed Windows program in EchoTrail's dataset, observed 5,632,009 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Behavior
Top Paths
- C:\Windows\System3297.97%
- C:\Windows\SysWOW642.03%
Top Hashes (SHA256)
- 34128709cb5bc2b222dc6f25561a07b1f90689800a84931ac5d37c50a548f90848.25%
- b20bbd7b8b5707acc00d7c51ef79771f22f2e201d4844252b675058ebea9e41618.75%
- 41f067c3a11b02fe39947f9eba68ae5c7cb5bd1872a6009a4cd1506554a9aba912.61%
- 434afbe89876afbc27b6fcd1995eadef02d9a76c6fb044b9108a2f48dfce5c6b8.22%
- 8a775b86ce1a057e290ccd26c59c96070684468a3119790743a346cd54f4dfdf3.9%
- aeb241959f4a7b7c29f45d27fd65c5326f9592d25badd1a7659de0da351bf96e2.33%
- eaab690ebd8ddf9ae452de1bc03b73c8154264dbd7a292334733b47a668ebf312.01%
- ed168045d0402e26305699442fc2b019b9967ca401e084748a763e8f08a5651c1.46%
- 78097c7cd0e57902536c60b7fa17528c313db20869e5f944223a0ba4c801d39b0.61%
- 39c59c362649090b4d34e5c8221c6e86552c07fe2df3478d591a68b70917bc0a0.53%
Process Ancestry
Top Grandparents
- LTSVC.exe97.27%
- services.exe1.62%
- msiexec.exe0.03%
- explorer.exe0.03%
- svchost.exe0.01%
- wininit.exe0.01%
- unins000.exe0.01%
- Nuix-Config.exe0.01%
- AVCProxy.exe<0.01%
Top Parents
- cmd.exe90.07%
- svchost.exe3.4%
- powershell.exe3.05%
- PMESetup.tmp1.87%
- QualysAgent.exe0.45%
- updateservice.exe0.33%
- msiexec.exe0.03%
- cscript.exe0.03%
- services.exe0.01%
Top Children
- conhost.exe99.99%
- WerFault.exe<0.01%
- schtasks.exe<0.01%
- wevtutil.exe<0.01%
- find.exe<0.01%
- mscorsvw.exe<0.01%
- NETSTAT.EXE<0.01%
- powershell.exe<0.01%
- sc.exe<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does sc.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Commonly launched by cmd.exe, powershell.exe, management agents, and installers. Spawns conhost.exe. Used for querying service status (sc query), starting/stopping services, and configuring service properties during installation or maintenance.
When is sc.exe suspicious?
Creating new services (sc create) — especially with binPath pointing to unusual locations, temp directories, or user-writable paths. Stopping security services (sc stop WinDefend, sc stop MpsSvc). Configuring services to change start type or credentials (sc config). Remote service management (sc \\<hostname> create/start). Executed by unusual parents or in rapid succession with other recon/config changes.
How do attackers abuse sc.exe?
Service creation for persistence: attackers use sc create to install a malicious service that runs at boot. Disabling security: sc stop and sc config used to disable Windows Defender, firewall, and EDR services. Lateral movement: sc \\<target> create followed by sc \\<target> start to execute payloads on remote systems (similar to PsExec). Service modification: changing an existing service binPath to point to a malicious executable.
Detection guidance
High-confidence: sc create with binPath pointing to temp, user profile, or download directories. sc stop targeting security services by name. sc with remote host (\\) targeting. Medium-confidence: sc config modifying binPath or start type. Manual vs. scripted distinction: timestamps between sequential sc.exe commands seconds apart suggest manual human interaction; milliseconds apart suggest scripted activity.
False positive notes
Extremely common in legitimate administration and installation scripts. Software installers frequently use sc to register and start services. Management agents use sc query for service health checks. Distinguish between sc query (read-only, low risk) and sc create/config/stop (write operations, higher risk).
Related Processes
Ask Rocky about sc.exe
Rocky answers questions about sc.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.