PsExec Remote Execution via PSEXESVC Pipe over SMB
Detects the presence of the 'PSEXESVC' named pipe activity over SMB, which is a hallmark indicator of the PsExec tool being used to facilitate remote execution and lateral movement.
Suricata
Detects the presence of the 'PSEXESVC' named pipe activity over SMB, which is a hallmark indicator of the PsExec tool being used to facilitate remote execution and lateral movement.
Already have an account?