2.2 | SOC Tier 2 | Pivoting around PsExec (Elastic Defend EDR)

وصف الدرس

Was PsExec run locally or from a remote machine? Building a timeline of PsExec activity in Elastic Defend, tracing parent-child process relationships, and the lesser-known .key file artifact that PSEXESVC.exe leaves behind. Resources: Sysmon v13.01 and PsExec v2.30 (techcommunity.microsoft.com, Sysinternals blog)

التحق بـ Chasing Rider لفتح المحتوى كاملًا.