Service Installation in Suspicious Folder

{
  "selection": {
    "Provider_Name": "Service Control Manager",
    "EventID": 7045,
    "ImagePath
| contains": [
      "\\AppData\\",
      "\\\\\\\\127.0.0.1",
      "\\\\\\\\localhost"
    ]
  },
  "filter_optional_zoom": {
    "ServiceName": "Zoom Sharing Service",
    "ImagePath
| contains": ":\\Program Files\\Common Files\\Zoom\\Support\\CptService.exe"
  },
  "condition": "selection and not 1 of filter_optional_*"
}

False Positives

• ⚠ Unknown