Potential Persistence Attempt Via Existing Service Tampering

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the modification of an existing service in order to execute an arbitrary payload when the service is started or killed as a potential method for persistence.