Potential Meterpreter/CobaltStrike Activity — Detection Rule

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Read the full analysis on IntelFusions