[LM] - Hunting for registry artifacts of service creation

Sergio Albea@Sergio_Albea

•updated Jul 14, 2026•12•0•27

This query helps to identify service creation events regardless of the tool/method used for service creation (even if the threat actors use the Windows API directly, without leaving any command line traces).