Potential PsExec Remote Execution

SigmaHQ Detections@sigmaHQ

•updated Sep 22, 2025•1•0•28

Detects potential PsExec command execution on remote systems by looking for common command-line flags used by the utility, specifically 'accepteula', user credentials (' -u ', ' -p '), and a remote path (' \\'). It filters out connections to localhost.