Malicious Service Installation via SCM — sc.exe Create or Suspicious ImagePath
Detects the installation of a new Windows service using sc.exe from a non-standard parent process (not services.exe) or the installation of a service with an executable path located in suspicious directories such as Temp, AppData, ProgramData, or Users folders.
CQL
