Service permissions hijacked for privileges abuse (reg via command)

Detects scenarios where an attacker modify the permissions of a service in order to abuse its privileges