PowerShell Script Installed as a Service

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

This rule detects the creation of a new Windows service where the service executable path contains 'powershell' or 'pwsh'. This behavior is often indicative of an adversary attempting to establish persistence or elevate privileges by running PowerShell scripts as a service.