Service Installation in Suspicious Folder — Detection Rule

Detects service installation in suspicious folder appdata

Read the full analysis on IntelFusions