Service StartupType Change Via PowerShell Set-Service

Title: Service StartupType Change Via PowerShell Set-Service
Status: test
Description:Detects the use of the PowerShell "Set-Service" cmdlet to change the startup type of a service to "disabled" or "manual"
References:
  -https://www.virustotal.com/gui/file/38283b775552da8981452941ea74191aa0d203edd3f61fb2dee7b0aea3514955
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-03-04
modified:None
Tags:

• -'attack.execution'
• -'attack.defense-impairment'
• -'attack.t1685'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
Image|endswith:'\powershell.exe' OriginalFileName:'PowerShell.EXE'   selection_cli:
    CommandLine|contains|all:
      -'Set-Service'
      -'-StartupType'

    CommandLine|contains:
      -'Disabled'
      -'Manual'

  condition:all of selection_*
Falsepositives:
  -False positives may occur with troubleshooting scripts
Level: medium