SnappyClient service persistence correlated with C2 beacon on ports 3333/3334
Detects the creation of a new Windows service where the service executable is located outside of standard system directories (e.g., C:\Windows\ or C:\Program Files\), which is followed by outbound network communication to known SnappyClient C2 ports 3333 or 3334.
YARA-L
