Suspicious Service Path Modification

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•1

Detects service path modification via the "sc" binary to a suspicious command or path