Service abuse with backdoored "command failure" (Reg via command)

Detects scenarios where an attacker modify the configuration of a service to trigger an action when the service is crashed.