Suspicious Process Execution via PsExec
Detects suspicious child processes of the PsExec service executable (PSEXESVC.exe). This activity could represent an adversary using PsExec for lateral movement and executing commands on a remote host.
Splunk (SPL)
