Potential Persistence via Existing Service Tampering
Detects the modification of an existing service's configuration (binpath or failure command) using 'sc.exe' or 'reg.exe' to execute an arbitrary payload. This is a common method for establishing persistence or escalating privileges by ensuring a malicious executable runs when the service starts or fails.
Sigma
