Impacket remote execution lateral movement (psexec/smbexec/wmiexec/atexec)
Detects behavioral artifacts associated with Impacket remote execution tools (such as wmiexec, smbexec, and atexec) on target hosts using Microsoft Defender XDR process telemetry. It identifies command-line signatures spawned by system processes like WmiPrvSE.exe, services.exe, and svchost.exe.
Microsoft Sentinel (KQL)
