Service abuse with malicious ImagePath (Reg via command)

Detects scenarios where an attacker modify the original service executable path with a malicious one.