Service Hardening via sc.exe sdset
Detects the creation of a Windows service followed by the use of "sc.exe sdset" to apply a highly restrictive security descriptor. This specific TTP is used by the REF4033 group (UAT-8099) to harden their malicious 'WalletServiceInfo' service, making it difficult for administrators to stop or delete.
Microsoft Sentinel (KQL)
