#EQL to detect Local Privilege Escalation by unquoted service path: process where process_name:c\:\\program.* AND -process_name:c\:\\*\\* AND parent_name:services.exe AND user_name=="system" #threathunting
-
indeed, it's a "Backward compatibility" like detection
still can be abused on win10+ (with admin privs) to persist (without creating a new service) and also elevate IL from high to system if one find a vulnsvc
