value:  APT32 modified Windows Services to ensure PowerShell scripts were loaded on the system. APT32 also creates a Windows service to establish persistence. 
name: Create or Modify System Process: Windows Service