PsExec Lateral Movement - psexec.exe or PSEXESVC Service Creation

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.