Service Binary in Suspicious Folder — Detection Rule

Detect the creation of a service with a service binary located in a suspicious directory

Read the full analysis on IntelFusions