sc.exe
Named by 4 kept items in this workspace.
Search every workspace for sc.exe. It matches the name as written, so it can find other things that share it.
The items that name it 4
Service control utility used by the threat actor to stop and delete security/logging services
Used to create persistence by installing dllhost.exe as a Windows service named WindowsUpdate.
Windows Service Control command-line tool used to run sdset (modify service DACL), sdshow (display security descriptor), and create (create a malicious service) for the attack
Windows command-line tool used to query service configuration (sc.exe qc SynaMan)
All technologies in this workspace.