Turning off services using sc exe
This query checks for attempts to turn off at least 10 existing services using sc.exe.
Microsoft Sentinel (KQL)

This query checks for attempts to turn off at least 10 existing services using sc.exe.

Already have an account?