PowerShell Code in Service Registry ImagePath
Detects when PowerShell code is written to the Windows Registry as part of a service's ImagePath. This technique can be used by adversaries to establish persistence and execute malicious PowerShell scripts when the service starts.
Sigma
