Detects a service installed by a client which has PID 0 or whose parent has PID 0
Read the full analysis on IntelFusions