Cobalt Strike psexec service install from ADMIN$ or hidden encoded PowerShell

ills3c Intel&Coffee@Ills3C

•updated yesterday•3•0•3

Detects Cobalt Strike psexec or psexec_psh lateral movement behavior where a Windows service (Event ID 7045) is installed using either an ADMIN$ binary path or a hidden encoded PowerShell command, followed by the spawned process executing rundll32.exe.