PsExec Service Child Process Execution as LOCAL SYSTEM
This rule detects the execution of a child process by the PSEXESVC.exe service, specifically when that child process runs with LOCAL_SYSTEM privileges. This indicates that a command was remotely initiated on the system with the highest possible privileges, rather than the privileges of the initiating user account. This behavior is characteristic of PsExec being used for remote execution with SYSTEM-level access.
Sigma
