ClientSetup MANC Service Creation (TAX#TRIDENT)
Detects the installation of the "MANC" service, which is used as a watchdog persistence mechanism for the ClientSetup payload in the TAX#TRIDENT campaign. This rule specifically looks for service installation events where the service name is "MANC".
Microsoft Sentinel (KQL)
