Service Installation in Suspicious Folder
Detects the installation of a new Windows service where the service executable's image path contains suspicious locations such as 'AppData' directories or remote IP addresses like '127.0.0.1' or 'localhost'. This can indicate an attempt at persistence or privilege escalation by adversaries installing malicious services in non-standard locations.
Sigma
