Suspicious New Service Creation — Detection Rule
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths
Detects creation of a new service via "sc" command or the powershell "new-service" cmdlet with suspicious binary paths