PsExec Tool Execution From Suspicious Locations - PipeName
Detects the creation of the default named pipe for PsExec (PSEXESVC) when the PsExec executable is run from suspicious locations such as temporary directories, public user folders, or common download/desktop locations. This activity can indicate the use of PsExec by an attacker.
Sigma
