Distribution from remote location
This query checks for alerts related to file drop and remote execution where the file name matches PsExec and similar tools used for distribution
Microsoft Sentinel (KQL)

This query checks for alerts related to file drop and remote execution where the file name matches PsExec and similar tools used for distribution

Already have an account?