CobaltStrike Service Installations - Security — Detection Rule

Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement

Read the full analysis on IntelFusions