http://news.poseidon-us.com/T6w7xB
I had an interesting call from a client recently – they had a number of “net use” and “psexec” commands pop up on a domain controller, all called from PSEXEC (thank goodness for a good EDR deployed across the board!!). The source IP was a VPN session.
http://news.poseidon-us.com/T6w7xB
http://news.poseidon-us.com/T6w7xB