NeedyMantis Windows Service Persistence Pointing to ProgramData Executable
Detects the creation of a new Windows service (EventCode 7045) where the service binary path (ImagePath) points to the ProgramData directory, with exclusions for known legitimate paths such as Windows Defender, Package Cache, and Chocolatey.
Splunk (SPL)
