Potential Meterpreter/CobaltStrike Activity (15619216-e993-4721-b590-4c520615a67d)

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service starting

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf)	Attack Pattern	Potential Meterpreter/CobaltStrike Activity (15619216-e993-4721-b590-4c520615a67d)	Sigma-Rules	1
Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	Potential Meterpreter/CobaltStrike Activity (15619216-e993-4721-b590-4c520615a67d)	Sigma-Rules	1
Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf)	Attack Pattern	Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	2
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	2