Service Executable Path Modification to Temporary Directories
This rule detects modifications to Windows service executable paths or service paths (ImagePath, ServicePath) where the new value points to common temporary directories (Temp, AppData, %temp%). This behavior can indicate an attempt by an adversary to persist on a system by modifying legitimate services to execute malicious payloads from temporary locations, often used for staging or evasion.
Microsoft Sentinel (KQL)
