PsExec/SMB Remote Execution Lateral Movement
Detects the execution of PsExec (psexec.exe or psexesvc.exe) where the binary is not digitally signed by Microsoft Corporation. This is often an indicator of renamed or tampered versions of the tool used for lateral movement or remote command execution.
SentinelOne
