huntrule

Windows CSExec Service File Creation via “csexecsvc.exe”

Flags creation of CSExec service binary csexecsvc.exe on Windows, a strong indicator of service-based execution setup.

FreeUnreviewedSigmamediumv1
title: Windows CSExec Service File Creation via “csexecsvc.exe”
id: 40f3616a-1b3a-48d9-b6c7-4a82336a6690
status: test
description: This rule matches file creation events where the target filename ends with \csexecsvc.exe, indicating a CSExec service component was installed for later execution. Attackers may use this behavior to establish execution via a Windows service, blending into normal file operations. The detection relies on Windows file event telemetry that includes the full target filename.
references:
  - https://github.com/malcomvetter/CSExec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_csexec_service.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-08-04
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \csexecsvc.exe
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: f0e2b768-5220-47dd-b891-d57b96fc0ec1
    type: derived

What it detects

This rule matches file creation events where the target filename ends with \csexecsvc.exe, indicating a CSExec service component was installed for later execution. Attackers may use this behavior to establish execution via a Windows service, blending into normal file operations. The detection relies on Windows file event telemetry that includes the full target filename.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.