Skip to content
Threat Feed
Subscribe

Tag

Process-Execution

2 briefs RSS
medium advisory

Detection of Sysinternals PsService Execution

This brief details the detection of Sysinternals PsService, a legitimate utility that can be abused by threat actors for service reconnaissance, manipulation, and persistence on Windows systems, potentially leading to privilege escalation or system disruption.

Sysinternals PsService sysinternals process-execution service-manipulation windows
1r 3t
medium advisory

Execution from Unusual Directory - Command Line

This rule identifies process execution from suspicious default Windows directories, which adversaries may abuse to hide malware in trusted paths to evade defenses.

Microsoft Defender XDR +1 execution defense-evasion windows process-execution
2r 2t