Service Startup Type Change Via Wmic.EXE (c0514f28-fdae-42df-b886-06e2b2bc5b37)

Detects changes to service startup type to 'disabled' or 'manual' using the WMIC command-line utility.

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Service Startup Type Change Via Wmic.EXE (c0514f28-fdae-42df-b886-06e2b2bc5b37)	Sigma-Rules	Disable or Modify Tools - T1685 (bbde9781-60aa-4b8a-a911-895b0c1b3872)	Attack Pattern	1
Service Startup Type Change Via Wmic.EXE (c0514f28-fdae-42df-b886-06e2b2bc5b37)	Sigma-Rules	Windows Management Instrumentation - T1047 (01a5a209-b94c-450b-b7f9-946497d91055)	Attack Pattern	1