Detect Potential Lateral Movement via PsExec, WMIExec, or Schtasks

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•2

This rule detects potential lateral movement activities by monitoring for the execution of 'psexec', 'wmiexec', or 'schtasks' commands within a short timeframe on the same computer. A count of 2 or more such command executions within an hour is flagged as suspicious, indicating potential adversary activity.