Cobalt Strike remote service install with PowerShell, rundll32 or ADMIN$ binary
Detects the installation of a Windows service (Event IDs 4697 or 7045) where the image path executes PowerShell, rundll32, or an ADMIN$ share binary, preceded within 10 minutes by a remote admin share access (Event ID 5140 to ADMIN$ or C$). This behavior is commonly associated with lateral movement frameworks such as Cobalt Strike.
Microsoft Sentinel (KQL)
