Service Auto-Start Registry Write to SYSTEM\Services by Non-Standard Process
This rule detects potentially malicious modifications to Windows service registry keys. It monitors the 'Services' registry hive for changes to the 'Start' value to identify services set to start automatically or at boot, or modifications to the 'ImagePath' value that do not conform to expected system-protected paths. This behavior is indicative of an adversary attempting to establish persistence by creating or modifying a malicious service.
CQL
