Suspicious DWAgent Installation and Service Creation
Detects the installation and execution of DWAgent (dwagsvc.exe) from the C:\ProgramData directory, specifically looking for service installation and startup commands. Threat actors like Kimsuky are known to use legitimate RMM tools like DWAgent to maintain persistent remote access while blending in with normal administrative activities.
Microsoft Sentinel (KQL)
