PsExec Remote Execution via -accepteula and UNC Path
Detects execution of PsExec or PsExec64 using the -accepteula flag targeting a remote host specified by a Universal Naming Convention (UNC) path. This pattern is commonly used for legitimate remote administration but is also a hallmark of lateral movement and remote code execution by attackers.
SentinelOne
