Service StartupType Change Via PowerShell Set-Service
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual". This activity can be indicative of an adversary attempting to impair defenses or achieve persistence by modifying service configurations.
Sigma
