Windows Process Creation: PsExec/PAExec Flags Indicating SYSTEM Execution

Flags indicating PsExec/PAExec-style execution as LOCAL SYSTEM using cmd/powershell/pwsh in process command lines.

FreeUnreviewedSigmahighv1

windows-process-creation-psexec-paexec-flags-indicating-system-execution-207b0396

title: "Windows Process Creation: PsExec/PAExec Flags Indicating SYSTEM Execution"
id: 6834f4c6-4dc8-4a2d-b8f7-e2a8547ccd37
related:
  - id: 8834e2f7-6b4b-4f09-8906-d2276470ee23
    type: similar
  - id: 207b0396-3689-42d9-8399-4222658efc99
    type: derived
status: test
description: This rule identifies Windows process creation events where the command line contains SYSTEM-assignment flags commonly used by PsExec/PAExec (including variations using cmd, powershell, or pwsh, and optional interactive sessions). Attackers use these utility-style flags to launch commands under LOCAL SYSTEM privileges, enabling privilege escalation and broader impact. Detection relies on process creation telemetry and command-line content matching, while excluding cases covered by a related PsExec-specific rule based on known tool strings.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.poweradmin.com/paexec/
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-05-22
modified: 2024-03-05
tags:
  - attack.resource-development
  - attack.t1587.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains|windash:
      - " -s cmd"
      - " -s -i cmd"
      - " -i -s cmd"
      - " -s pwsh"
      - " -s -i pwsh"
      - " -i -s pwsh"
      - " -s powershell"
      - " -s -i powershell"
      - " -i -s powershell"
  filter_main_exclude_coverage:
    CommandLine|contains:
      - paexec
      - PsExec
      - accepteula
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Weird admins that rename their tools
  - Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing
level: high
license: DRL-1.1

What it detects

This rule identifies Windows process creation events where the command line contains SYSTEM-assignment flags commonly used by PsExec/PAExec (including variations using cmd, powershell, or pwsh, and optional interactive sessions). Attackers use these utility-style flags to launch commands under LOCAL SYSTEM privileges, enabling privilege escalation and broader impact. Detection relies on process creation telemetry and command-line content matching, while excluding cases covered by a related PsExec-specific rule based on known tool strings.

Known false positives

Weird admins that rename their tools
Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.