Potentially we could also add the create process and reg add block to the set registry value. Would you mind taking another look?
I think this is a great idea that will lead to cleaner rules which follow the DRY principle. I catched up on this and provided the commit 13a4bf1 which implements your suggestion. We could also think about adding the sc.exe command to the create-service.yml rule in the future.
Originally posted by @0x534a in #207 (comment)