Potential Lateral Movement Through Psexec
Detects the use of PsExec for lateral movement, a technique observed in use by Warlock ransomware affiliates. This rule identifies the creation or execution of the default PsExec service ('PSEXESVC.exe') on a target host.
YARA-L
