PsExec launches SQL Server Management Studio (ssms.exe)

Ibrahim Saud@tektrix

•updated 22 days ago•0•0•3

Detects the invocation of SQL Server Management Studio (ssms.exe) by the PsExec or PsExec service process. This behavior is indicative of administrative tools being used for potentially unauthorized remote execution or lateral movement.