Meterpreter or Cobalt Strike Getsystem Service Installation - Security (ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34)

Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Meterpreter or Cobalt Strike Getsystem Service Installation - Security (ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34)	Sigma-Rules	Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf)	Attack Pattern	1
Meterpreter or Cobalt Strike Getsystem Service Installation - Security (ecbc5e16-58e0-4521-9c60-eb9a7ea4ad34)	Sigma-Rules	Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	1
Create Process with Token - T1134.002 (677569f9-a8b0-459e-ab24-7f18091fa7bf)	Attack Pattern	Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	2
Access Token Manipulation - T1134 (dcaa092b-7de9-4a21-977f-7fcb77e89c48)	Attack Pattern	Token Impersonation/Theft - T1134.001 (86850eff-2729-40c3-b85e-c4af26da4a2d)	Attack Pattern	2