PsExec Service File Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•18

Detects the creation of the default PsExec service executable file, 'PSEXESVC.exe', which is indicative of PsExec being used to install and execute a service on a system.