Suspicious New Service Creation

SigmaHQ Detections@sigmaHQ

•updated Nov 18, 2022•0•0•0

Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths