Service Recovery Configuration Modification
Detects modifications to the registry values responsible for service recovery actions, specifically the 'FailureCommand' or 'FailureActions' values. This can indicate an attacker is configuring a service to execute a malicious payload upon failure for persistence or privilege escalation.
Microsoft Sentinel (KQL)
