you are a threat hunter in your company. As part

of your duties, you detected a local administratort

executing remote comand with PsExec

what do you do$?$

call the incident team immidiately

check whether this is normal as per the security policy

nothing, system administrator use PsExec all the time

call the incident reponces team if the command in PsExec is encoded