Suspicious Remote Execution Tool Usage

nomit vyas@xoxo

•updated Jun 21, 2026•0•0•4

This rule detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell. It specifically looks for multiple executions of these tools within a 5-minute window, originating from non-system accounts and not from standard Windows system directories. This behavior can indicate lateral movement or other malicious activity within a network.