Meterpreter or Cobalt Strike Getsystem Service Installation - System — Detection Rule

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation