Add current Acronis Cyber Protect service names to service-tamper rule

This rule already flags 'Acronis VSS Provider', 'AcronisAgent', and
'AcrSch2Svc' (legacy Acronis True Image/Backup service names) as
security-relevant services targeted by ransomware/tampering scripts.
Adds the current Acronis Cyber Protect (EDR/XDR) service/process
identifiers that weren't yet covered: AcronisCyberProtectionService,
AcronisActiveProtectionService, and aakore.

Sources: Acronis KB articles documenting Cyber Protect's installed
services.

Author: Filip Olszak

rules/windows/process_creation/proc_creation_win_susp_service_tamper.yml

@@ -19,7 +19,7 @@ references:
     - https://learn.microsoft.com/en-us/windows/win32/cimwin32prov/delete-method-in-class-win32-service
 author: Nasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)
 date: 2022-09-01
-modified: 2025-08-27
+modified: 2026-07-17
 tags:
     - attack.impact
     - attack.defense-impairment
@@ -63,8 +63,11 @@ detection:
     selection_services:
         CommandLine|contains:
             - '143Svc'
+            - 'aakore'
             - 'Acronis VSS Provider'
+            - 'AcronisActiveProtectionService'
             - 'AcronisAgent'
+            - 'AcronisCyberProtectionService'
             - 'AcrSch2Svc'
             - 'AdobeARMservice'
             - 'AHS Service'