Suspicious Service Installation

Detects service installations with binaries in temporary or suspicious paths — indicative of malware persistence or lateral movement.