Robuta

https://www.elastic.co/docs/reference/security/prebuilt-rules/rules/windows/defense_evasion_sc_sdset Service DACL Modification via sc.exe | Prebuilt detection rules reference Identifies DACL modifications to deny access to a service, making it unstoppable, or hide it from system and users. Rule type: eql Rule indices:... sc exedetection rulesservicedaclmodification