PsExec/PAExec Escalation to LOCAL SYSTEM
This rule detects the use of PsExec or PAExec with command-line flags designed to escalate privileges to the LOCAL_SYSTEM account. Specifically, it looks for the '-s' flag, optionally combined with '-i', followed by common shell executables like 'cmd', 'powershell', or 'pwsh'. This behavior is indicative of an attempt to gain SYSTEM-level access on a Windows machine.
Sigma
