PsExec/Remote Admin Tools Executed on Domain Controllers

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•2

This rule detects the execution of common remote administration tools (PsExec, PaExec, RemCom) specifically on devices identified as domain controllers based on their naming convention.