Sponsor of the Day:
Jerkmate
https://detection.fyi/sigmahq/sigma/windows/builtin/security/win_security_meterpreter_or_cobaltstrike_getsystem_service_install/
Meterpreter or Cobalt Strike Getsystem Service Installation - Security | Detection.FYI
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
cobalt strikeservice installationsecurity detectionmeterpretergetsystem
https://docs.rapid7.com/metasploit/getsystem-command-work/
Getsystem Command | Metasploit Documentation
metasploit documentationgetsystemcommand
https://docs.rapid7.com/metasploit/meterpreter-getsystem/
Meterpreter getsystem | Metasploit Documentation
metasploit documentationmeterpretergetsystem