Service Binary in Suspicious Folder

Detect the creation of a service with a service binary located in a suspicious directory