Rule Info
Name
Suspicious Service Installation with Potentially Malicious Command Line
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects installation of suspicious services with command line patterns commonly associated with malicious activity, such as the use of cmd.exe with pipe commands or PowerShell with encoded commands, which may indicate attempts to establish persistence or execute malicious payloads.
Date
2026-03-03 00:00:00
Modified
None
Id
8b5a0c1d-3e7f-4a2b-9c6d-1f8e5b4a7c3d
Tags
attack.persistence attack.privilege-escalation attack.t1543.003
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR