PsExec lateral movement via psexesvc.exe service lineage
Detects the execution of the PsExec service (psexesvc.exe) which is commonly used for remote command execution and lateral movement. This rule monitors for process creation events where psexesvc.exe is spawned by services.exe or wininit.exe, indicative of a remote service installation typically associated with administrative or adversary activity.
Microsoft Sentinel (KQL)
