CSExec Service File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the creation of the default CSExec service executable file, 'csexecsvc.exe', which indicates the installation and potential execution of the CSExec service. CSExec is a tool similar to PsExec, used for remote command execution.