MQTTDoor cplsupport service install masquerading as Problem Reports
Detects the use of sc.exe or cplsupport.exe with command-line arguments often associated with service installation, configuration, or modification. This behavior may indicate an adversary attempting to establish persistence or escalate privileges by creating or modifying Windows services.
Microsoft Sentinel (KQL)
