PowerShell Script Installed as Windows Service

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•21

This rule detects the creation of a new Windows service where the service's ImagePath contains 'powershell' or 'pwsh'. This indicates that a PowerShell script is being used as the executable for a newly installed service, which is a common technique for persistence or privilege escalation by adversaries.