PsExec Lateral Movement via PSEXESVC Service Process Lineage
Detects the execution of the PsExec service component (psexesvc.exe), which is often used for remote command execution and lateral movement. The rule monitors for the process starting, particularly when it originates from legitimate Windows service management processes like services.exe or wininit.exe.
Cortex XDR
