A user account authenticating from unusual systems (e.g., the receptionist's account logging into the file server at 2 AM) > - **New service installations** — PsExec creates a temporary service; monitor for Service Creation events (Windows Event ID 7045) > - **Unusual process execution** — WMI-based