PsExec from the help desk to a file server
A file server shows a network logon, a share write to ADMIN$, a new PSEXESVC service, and a command saving the SAM hive. Tie them together and trace the source workstation.
Briefing
FS-02 raised an alert for reg save HKLM\SAM. Admin accounts do sometimes use PsExec here, so the question is whether this was one of them, and from where.
PsExec copies PSEXESVC.exe to the ADMIN$ share (5145), installs it as a service (7045), and runs commands as children of that service (4688). The 4624 before it shows who connected and from which machine.
FS-02 · Windows event logs
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.