Non-privileged Usage of Reg or Powershell — Detection Rule
Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry
Search for usage of reg or Powershell by non-privileged users to modify service configuration in registry