Rule Info
Tags
attack.execution attack.t1562.001 attack.defense_evasion DEMO
Modified
None
Author
Nasreddine Bencherchali (Nextron Systems)
Name
Service StartupType Change Via PowerShell Set-Service
Description
Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"
Date
2023-03-04 00:00:00
Reference
Id
62b20d44-1546-4e61-afce-8e175eb9473c
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR