PsExec Execution Detection
Detects the execution of PsExec, a legitimate but often abused tool for remote command execution. The rule specifically looks for the executable name 'psexec.exe' or its original filename 'psexec.c' in process creation events.
Sigma
