SMB admin share access from unusual source
Alert details
Alert IDda637912300004
Created2026-08-16 20:07 UTC
Detection source-
Threat family-
SourceDemo
Entities
Device
corp-srv-app02
High riskHigh exposure
Usersvc-backup@propera.local
Related incidentINC-01003
Evidence
Network
SMB connection to admin share
IP 10.10.4.87 · Inbound
Process
PsExec-style service execution
psexec.exe \\corp-srv-app02 -s cmd.exe
C:\Users\j.doe\AppData\Local\Temp\psexec.exe
