Suspicious Service Binary in User-Writable or System Directory
Detects a Windows service binary being created or executed from suspicious directories that are commonly used by adversaries for defense evasion or persistence. The rule specifically looks for processes whose parent is 'services.exe' or 'svchost.exe' and whose image path contains known suspicious user-writable or system-specific directories.
Sigma
