Windows Process Creation: Sysinternals PsService (PsService*.exe) Execution

Alerts on execution of Sysinternals PsService (PsService*.exe) on Windows, which can support service discovery and tampering.

FreeUnreviewedSigmamediumv1

windows-process-creation-sysinternals-psservice-psservice-exe-execution-3371f518

title: "Windows Process Creation: Sysinternals PsService (PsService*.exe) Execution"
id: cdf01bc6-e7fb-4a37-8f8e-11ca75cb168d
status: test
description: This rule flags process creation events where the executable name corresponds to Sysinternals PsService variants (psservice.exe and PsService*.exe). Attackers may use PsService to perform service-oriented discovery or to prepare for tampering as part of broader privilege escalation or persistence efforts. It relies on Windows process creation telemetry, matching the process image/original filename. Legitimate administrative use can also trigger the alert.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psservice
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psservice.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-16
modified: 2026-06-29
tags:
  - attack.privilege-escalation
  - attack.discovery
  - attack.persistence
  - attack.t1543.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: psservice.exe
    - Image|endswith:
        - \PsService.exe
        - \PsService64.exe
        - \PsService64a.exe
  condition: selection
falsepositives:
  - Legitimate use of PsService by an administrator
level: medium
license: DRL-1.1
related:
  - id: 3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f
    type: derived

What it detects

This rule flags process creation events where the executable name corresponds to Sysinternals PsService variants (psservice.exe and PsService*.exe). Attackers may use PsService to perform service-oriented discovery or to prepare for tampering as part of broader privilege escalation or persistence efforts. It relies on Windows process creation telemetry, matching the process image/original filename. Legitimate administrative use can also trigger the alert.

Known false positives

Legitimate use of PsService by an administrator

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.