New Service Creation Using Sc.EXE
Detects the creation of a new service using the "sc.exe" utility. This activity can be used by adversaries for persistence or privilege escalation by creating a malicious service that executes at system startup or with elevated privileges.
Sigma
