System Service Tampering (sc.exe) to Persistence
Correlates the creation of arbitrary new Windows services via sc.exe with immediate subsequent execution of binaries located in Public or ProgramData directories. This behavior is indicative of an attacker establishing persistence on a system by creating a malicious service that executes from a common writable location.
Microsoft Sentinel (KQL)
