TinkyWinkey Keylogger Suspicious Service Installation
Detects the creation of a new Windows service configured to start automatically from a suspicious file path. This behavior is indicative of persistence mechanisms used by malware like the Tinky Winkey keylogger.
Microsoft Sentinel (KQL)
