[WINDOWS-SYSMON] Possible hidden service installed

alert any $HOME_NET any -> $HOME_NET any (msg:"[WINDOWS-SYSMON] Possible hidden service installed"; program:*Sysmon*; event_id:13; content:"EventType: SetValue"; nocase; content:"TargetObject: HKLM\\System\\CurrentControlSet\\Services\\"; nocase; content:"rundll32"; nocase; content:!"CbDefense"; content:!"CbDisk"; content:!"ctinet"; content:!"ctifile"; content:!"UsoSvc"; content:!"TrustedInstaller"; content:!"CiscoOrbital"; sid:5008350; content:!"\BITS\"; reference:url,www.bleepingcomputer.com/tutorials/how-malware-hides-as-a-service/; classtype:suspicious-command; rev:2;)