Ransomware Affiliate Lateral Movement via PsExec-Style Service, Admin Share and

Suraj A@cytech

•updated yesterday•2•0•6

Detects lateral movement behaviors associated with ransomware affiliates, including remote service creation using PsExec-style binaries or admin-share paths, command-line access to SMB admin shares, and enabling Remote Desktop Protocol via registry modifications or firewall rule updates.