huntrule

Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact

Alerts on creation of PsExec key files in C:\Windows\PSEXEC-*.key, indicating remote execution activity.

FreeReviewedSigma · High · v2
Product
windows
Category
file_event
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-01-21
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Persistence → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies when a PsExec key file is created on a Windows host, matching filenames that start with C:\Windows\PSEXEC- and end with .key. Attackers commonly rely on PsExec-style remote execution, and the key file is written to the file system as part of command execution. The detection relies on file creation or file event telemetry that includes TargetFilename.

Reporting behind it

Related detections9 linkedT1543.003 — drag to rearrange
Malicious Service Permissions Hijacked for Privileges Abuse - PowerShell (via powershell)
Suspicious File with High Volume Downloaded via BITS (via bits)
Suspicious Domain Account Creation Named backup_EA (via process_creation)
Malicious Domain and Enterprise Admins Group Addition via net group Domain Add (via process_creation)
Malicious Remote Payload Deployment via WMIC Node Process Call Create with bitsadmin Transfer (via process_creation)
Malicious Service Created With Binary Path in ProgramData
Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)
Malicious AuKill EDR Killer Kernel Driver Load via Process Explorer Driver (via image_load)
Suspicious TermService ServiceDll Hijack via Registry (via registry_set)
Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact
Pivot detection · T1543.003 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.