PUA - CsExec Execution (d08a2711-ee8b-4323-bdec-b7d85e892b31)

Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Malware - T1587.001 (212306d8-efa4-44c9-8c2d-ed3d2e224aa0)	Attack Pattern	PUA - CsExec Execution (d08a2711-ee8b-4323-bdec-b7d85e892b31)	Sigma-Rules	1
PUA - CsExec Execution (d08a2711-ee8b-4323-bdec-b7d85e892b31)	Sigma-Rules	Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4)	Attack Pattern	1
Malware - T1587.001 (212306d8-efa4-44c9-8c2d-ed3d2e224aa0)	Attack Pattern	Develop Capabilities - T1587 (edadea33-549c-4ed1-9783-8f5a5853cbdf)	Attack Pattern	2
System Services - T1569 (d157f9d2-d09a-4efa-bb2a-64963f94e253)	Attack Pattern	Service Execution - T1569.002 (f1951e8a-500e-4a26-8803-76d95c4554b4)	Attack Pattern	2