PsExec Service Installation Detection
This rule detects the installation and execution of the PsExec service (PSEXESVC) on Windows systems. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation event. The rule then checks if the installed service's name is 'PSEXESVC' or if its image path ends with '\PSEXESVC.exe'. This is a common indicator of PsExec being used for remote execution.
Sigma
