Prometei UPlugPlay Service Creation
Detects the creation of the 'UPlugPlay' Windows Service, a known persistence mechanism for the Prometei botnet. The malware may create the service using the command-line tool 'sc.exe' or directly via Windows APIs, which generates Event ID 7045.
Microsoft Sentinel (KQL)
