Remote Service Activity via SVCCTL Named Pipe — Detection Rule

Detects remote service activity via remote access to the svcctl named pipe

Read the full analysis on IntelFusions