PSEXEC Remote Execution File Artefact
Detects the creation of the PSEXEC key file, which is generated whenever a PsExec command is executed. This file is written to the file system and recorded in the USN Journal on the target system, serving as an indicator of PsExec activity.
Sigma
