PsExec Tool Execution From Suspicious Locations - PipeName

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack