Renamed PsExec Service Execution
Detects the execution of PsExec's service component (psexesvc.exe) when it has been renamed. This often indicates an attempt to evade detection by security tools that monitor for the default service name, as legitimate administrators typically use the original name.
Sigma
