BIOC
Informational
✕
Psexesvc.exe executes a command from a remote host
Psexesvc.exe executes to run a command received from a remote host via PsExec.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: System Services: Service Execution (T1569.002)
Indicator:
Process action type = execution AND target process name = psexesvc.exe AND process execution signature = Signed AND process execution signer = Microsoft Corporation Host host os = windows
Preventable: yes