PsExec Remote Service Execution for Lateral Movement (T1569.002)

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•1

Detects the execution of processes associated with remote command execution, specifically identifying the PsExec service (psexesvc.exe) or the invocation of command shell (cmd.exe) by the Service Control Manager (services.exe) with remote path arguments.