PsExec Lateral Movement via PSEXESVC Named Pipe over SMB

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects the use of the PSEXESVC named pipe during a write operation over the SMB protocol, which is indicative of lateral movement using the PsExec tool.