Windows Process Creation: PsExec/PAExec Flags Indicating SYSTEM Execution
Flags indicating PsExec/PAExec-style execution as LOCAL SYSTEM using cmd/powershell/pwsh in process command lines.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-05-22
- Updated
- 2026-07-30
ATT&CK techniques
Resource DevRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies Windows process creation events where the command line contains SYSTEM-assignment flags commonly used by PsExec/PAExec (including variations using cmd, powershell, or pwsh, and optional interactive sessions). Attackers use these utility-style flags to launch commands under LOCAL SYSTEM privileges, enabling privilege escalation and broader impact. Detection relies on process creation telemetry and command-line content matching, while excluding cases covered by a related PsExec-specific rule based on known tool strings.
Reporting behind it
- learn.microsoft.comhttps://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- poweradmin.comhttps://www.poweradmin.com/paexec/
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: PsExec/PAExec Flags Indicating SYSTEM Execution"
id: 6834f4c6-4dc8-4a2d-b8f7-e2a8547ccd37
related:
- id: 8834e2f7-6b4b-4f09-8906-d2276470ee23
type: similar
- id: 207b0396-3689-42d9-8399-4222658efc99
type: derived
status: test
description: This rule identifies Windows process creation events where the command line contains SYSTEM-assignment flags commonly used by PsExec/PAExec (including variations using cmd, powershell, or pwsh, and optional interactive sessions). Attackers use these utility-style flags to launch commands under LOCAL SYSTEM privileges, enabling privilege escalation and broader impact. Detection relies on process creation telemetry and command-line content matching, while excluding cases covered by a related PsExec-specific rule based on known tool strings.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- https://www.poweradmin.com/paexec/
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_susp_psexec_paexec_flags.yml
author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2021-05-22
modified: 2024-03-05
tags:
- attack.resource-development
- attack.t1587.001
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains|windash:
- " -s cmd"
- " -s -i cmd"
- " -i -s cmd"
- " -s pwsh"
- " -s -i pwsh"
- " -i -s pwsh"
- " -s powershell"
- " -s -i powershell"
- " -i -s powershell"
filter_main_exclude_coverage:
CommandLine|contains:
- paexec
- PsExec
- accepteula
condition: selection and not 1 of filter_main_*
falsepositives:
- Weird admins that rename their tools
- Software companies that bundle PsExec/PAExec with their software and rename it, so that it is less embarrassing
level: high
license: DRL-1.1