Suspicious Execution of PsExec Service (via process_creation)

title: Suspicious Execution of PsExec Service (via process_creation)
id: f83d4764-bc15-55db-827a-c7e7720275ca
status: stable
description: This rule detects launch of the PSEXESVC service, which means that this system was the target of a psexec remote execution
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
    - https://www.youtube.com/watch?v=ro2QuZTIMBM
author: Huntrule Team
date: 2026-04-01
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1569.002
    - attack.t1021.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        - Image: 'C:\Windows\PSEXESVC.exe'
        - OriginalFileName: 'psexesvc.exe'
    condition: selection
falsepositives:
    - Unknown
level: medium