PsExec Service Creation or Execution
This rule detects the creation of the PsExec service (PSEXESVC, psexesvc, svcsvc, spoolsrv) or the execution of psexec.exe. PsExec is a legitimate Microsoft tool that allows administrators to execute processes on remote systems, but it is frequently abused by attackers for lateral movement and remote execution.
Microsoft Sentinel (KQL)
