https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_sc_sdset
Service DACL Modification via sc.exe | Prebuilt detection rules reference
Identifies DACL modifications to deny access to a service, making it unstoppable, or hide it from system and users. Rule type: eql Rule indices:...
sc exedetection rulesservicedaclmodification