Add sc.exe command to the create-service.yml rule

[mr-tz]

Potentially we could also add the create process and reg add block to the set registry value. Would you mind taking another look?

I think this is a great idea that will lead to cleaner rules which follow the DRY principle. I catched up on this and provided the commit 13a4bf1 which implements your suggestion. We could also think about adding the sc.exe command to the create-service.yml rule in the future.

Originally posted by @0x534a in https://github.com/fireeye/capa-rules/issues/207#issuecomment-750488674

[franklbh]

@mr-tz Hi, is this issue still valid? If so, I'd love to take a look at this issue.

[mr-tz]

sure, thanks

[CosmoWorker]

@mr-tz I made a pr #1124 on this issue. Could you please take a look when you have a chance? Any feedback on the direction is highly appreciated. The issue seemed inactive for a while, so I decided to pick it up.