Windows Process Creation: Renamed PAExec Application Execution

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1202Indirect Command Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies execution of a renamed PAExec binary by matching specific file metadata and multiple known import-hash (IMPHASH) values tied to PAExec. Renaming this utility is a common attacker tradecraft to reduce visibility and blend into legitimate administration tooling. It relies on Windows process creation telemetry, including process image path, file description, original filename, product string, and importer-hash values.

Reporting behind it

Related detections9 linkedT1202 — drag to rearrange

Windows SFTP.exe Indirect Command Execution via ProxyCommand

WSL Process Execution of Kali Linux on Windows

Windows vshadow.exe Proxy Execution via -exec Script/Command

Windows ConHost Spawning Suspicious Script and Command-Line Child Processes

Windows Execution of Renamed NirCmd.exe (nircmd.exe/nircmdc.exe) via PE OriginalFileName

Windows: Detect renamed PingCastle binary execution via PE metadata and scanner command-line

Windows Process Creation: Execution of Renamed curl.exe via PE Metadata

Suspicious Child Process Creation from BgInfo.EXE on Windows

Windows Bash.exe Launched Without Script Execution Arguments

Windows Process Creation: Renamed PAExec Application Execution

Pivot detection · T1202 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-process-creation-renamed-paexec-application-execution-c4e49831

title: "Windows Process Creation: Renamed PAExec Application Execution"
id: b46c74f5-ac02-4d04-a595-c70cd9a5ba54
related:
  - id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b
    type: obsolete
  - id: c4e49831-1496-40cf-8ce1-b53f942b02f9
    type: derived
status: test
description: This rule identifies execution of a renamed PAExec binary by matching specific file metadata and multiple known import-hash (IMPHASH) values tied to PAExec. Renaming this utility is a common attacker tradecraft to reduce visibility and blend into legitimate administration tooling. It relies on Windows process creation telemetry, including process image path, file description, original filename, product string, and importer-hash values.
references:
  - https://www.poweradmin.com/paexec/
  - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_paexec.yml
author: Florian Roth (Nextron Systems), Jason Lynch, Huntrule Team
date: 2021-05-22
modified: 2024-11-23
tags:
  - attack.stealth
  - attack.t1202
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Description: PAExec Application
    - OriginalFileName: PAExec.exe
    - Product|contains: PAExec
    - Hashes|contains:
        - IMPHASH=11D40A7B7876288F919AB819CC2D9802
        - IMPHASH=6444f8a34e99b8f7d9647de66aabe516
        - IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f
        - IMPHASH=1a6cca4d5460b1710a12dea39e4a592c
  filter_main_known_location:
    - Image|endswith: \paexec.exe
    - Image|startswith: C:\Windows\PAExec-
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Weird admins that rename their tools
  - Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing
  - When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]"
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL