All Detections

Service StartupType Change Via PowerShell Set-Service

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 202504

Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Sigma