Service StartupType Change Via PowerShell Set-Service — Detection Rule

Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"

Read the full analysis on IntelFusions