Service abuse with malicious ImagePath (service)

Detects scenarios where an attacker modify the original service executable path with a malicious one.