Toy Ghouls bird-agent backdoor service install (cplsupport/wtass)
Detects the execution of known potentially malicious tools cplsupport.exe and wtass.exe with install parameters, or the creation of a Windows service associated with these filenames using sc.exe. This activity is indicative of service-based persistence or malicious software installation.
Microsoft Sentinel (KQL)
