Service Installed By Unusual Client - System Process
Detects the creation of a new Windows service where the creating process has a Process ID (PID) of 0 or its parent process has a PID of 0. This is an unusual and suspicious behavior, as PID 0 is typically reserved for the System Idle Process or the System process itself, which should not be directly creating services. This could indicate a highly privileged process or kernel-level activity attempting to establish persistence or escalate privileges.
Sigma
