Suspicious High-Priority Service Creation For EDR Evasion
Detects the creation or modification of a Windows service to belong to a high-priority service group. Adversaries may use this technique, as seen with the EDRStartupHinder tool, to ensure their malicious service runs before security products, allowing them to disable or tamper with EDR/AV solutions before they can initialize.
Sigma
