I would like to create a indicator on PsExec’s use of the C$, ADMIN$, and/or IPC$ shares and identifying User Access Control (UAC) events 552 and 4648 are indicative of an attacker attempting to use the runas command or authenticate against a remote host as an alternative user, #privilegeEscalation.
