Meterpreter or Cobalt Strike Getsystem Service Installation - System (843544a7-56e0-4dcc-a44f-5cc266dd97d6)

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf)	Attack Pattern	Meterpreter or Cobalt Strike Getsystem Service Installation - System (843544a7-56e0-4dcc-a44f-5cc266dd97d6)	Sigma-Rules	1
Meterpreter or Cobalt Strike Getsystem Service Installation - System (843544a7-56e0-4dcc-a44f-5cc266dd97d6)	Sigma-Rules	Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	1
Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf)	Attack Pattern	Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	2
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	2