Windows PsExec Key File Creation via C:\Windows\PSEXEC-*.key

title: Windows PsExec Key File Creation via C:\Windows\PSEXEC-*.key
id: cd4ab3fa-f4ff-4634-9cf5-1ed76a8578bf
status: test
description: This rule identifies creation of the PsExec key file on Windows by matching file events where the target filename starts with C:\Windows\PSEXEC- and ends with .key. Attackers commonly use PsExec for remote execution, and these key artifacts are written to disk during execution. The detection relies on file system telemetry that records file creation with the specific filename pattern used by PsExec.
references:
  - https://aboutdfir.com/the-key-to-identify-psexec/
  - https://twitter.com/davisrichardg/status/1616518800584704028
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-21
modified: 2023-02-23
tags:
  - attack.lateral-movement
  - attack.privilege-escalation
  - attack.execution
  - attack.persistence
  - attack.t1136.002
  - attack.t1543.003
  - attack.t1570
  - attack.s0029
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|startswith: C:\Windows\PSEXEC-
    TargetFilename|endswith: .key
  condition: selection
falsepositives:
  - Unlikely
level: high
license: DRL-1.1
related:
  - id: 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4
    type: derived