PSEXEC Remote Execution File Artefact (304afd73-55a5-4bb9-8c21-0b1fc84ea9e4)

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32)	Attack Pattern	PSEXEC Remote Execution File Artefact (304afd73-55a5-4bb9-8c21-0b1fc84ea9e4)	Sigma-Rules	1
Lateral Tool Transfer - T1570 (bf90d72c-c00b-45e3-b3aa-68560560d4c5)	Attack Pattern	PSEXEC Remote Execution File Artefact (304afd73-55a5-4bb9-8c21-0b1fc84ea9e4)	Sigma-Rules	1
Domain Account - T1136.002 (7610cada-1499-41a4-b3dd-46467b68d177)	Attack Pattern	PSEXEC Remote Execution File Artefact (304afd73-55a5-4bb9-8c21-0b1fc84ea9e4)	Sigma-Rules	1
Windows Service - T1543.003 (2959d63f-73fd-46a1-abd2-109d7dcede32)	Attack Pattern	Create or Modify System Process - T1543 (106c0cf6-bf73-4601-9aa8-0945c2715ec5)	Attack Pattern	2
Domain Account - T1136.002 (7610cada-1499-41a4-b3dd-46467b68d177)	Attack Pattern	Create Account - T1136 (e01be9c5-e763-4caf-aeb7-000b416aef67)	Attack Pattern	2