Rule Info
Name
Remote Execution Using PsExec
Author
MalGamy (Nextron Systems)
Description
Detects suspicious use of PsExec to remotely execute a batch file located in unusual directories. This could indicate lateral movement or malicious activity, as seen in some cyberattack scenarios.
Date
2024-11-10 00:00:00
Modified
None
Id
8e3e6fd0-b0b3-40d3-b7b3-5b350b5a018f
Tags
attack.lateral-movement attack.execution
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR