TiFlux RMM - Service Creation for Persistence
Identifies the creation of the specific background system service associated with TiFlux, cementing its persistence on the host. This rule specifically looks for the 'sc.exe' utility being used with the 'create' command and 'TiFlux.start= auto' in the command line, indicating the creation of a service for persistence.
Microsoft Sentinel (KQL)
