PsExec-Style Remote Service Creation for Lateral Movement

Ibrahim Saud@tektrix

•updated 8 days ago•0•0•1

Detects potential lateral movement by monitoring for the creation of services associated with PsExec (e.g., PSEXESVC or ADMIN$ share usage), followed by a network connection over SMB (port 445) and the subsequent execution of the corresponding remote process.