Windows PsExec Execution Triggered by psexec.exe Process Creation

title: Windows PsExec Execution Triggered by psexec.exe Process Creation
id: fec4a04a-5406-495b-b965-b287630d770b
status: test
description: This rule matches Windows process creation events where the executable path ends with \psexec.exe or the original file name is psexec.c. PsExec is commonly used to remotely start processes over Windows networks, so its execution can indicate lateral movement or remote administration activity by an attacker. The detection relies on process creation telemetry, including the process image path and the OriginalFileName field.
references:
  - https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml
author: omkar72, Huntrule Team
date: 2020-10-30
modified: 2023-02-28
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.t1569
  - attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|endswith: \psexec.exe
    - OriginalFileName: psexec.c
  condition: selection
falsepositives:
  - Administrative scripts.
level: medium
license: DRL-1.1
related:
  - id: 730fc21b-eaff-474b-ad23-90fd265d4988
    type: derived