CsExec Remote Execution Tool Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•16

Detects the execution of 'csexec.exe', a remote execution tool similar to PsExec. This tool can be used by attackers for lateral movement or remote code execution within a network.