Recon Commands (ipconfig, tasklist) Executed via PsExec Session

Detects the execution of reconnaissance commands (ipconfig.exe or tasklist.exe) launched directly by the PsExec service (psexesvc.exe). This pattern is often indicative of post-exploitation discovery activities following lateral movement using PsExec.