Metasploit Or Impacket Service Installation Via SMB PsExec

SigmaHQ Detections@sigmaHQ

•updated Nov 24, 2025•0•0•1

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation