PsExec Service Execution
This rule detects the creation of the PSEXESVC.exe process, which is the service component of PsExec. The presence and execution of this service indicate that PsExec was used to remotely execute commands or applications on the system.
Sigma
