Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact
Alerts on creation of PsExec key files in C:\Windows\PSEXEC-*.key, indicating remote execution activity.
- Product
- windows
- Category
- file_event
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-01-21
- Updated
- 2026-07-31
ATT&CK techniques
Persistence → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies when a PsExec key file is created on a Windows host, matching filenames that start with C:\Windows\PSEXEC- and end with .key. Attackers commonly rely on PsExec-style remote execution, and the key file is written to the file system as part of command execution. The detection relies on file creation or file event telemetry that includes TargetFilename.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PsExec Remote Execution Creates PSEXEC-*.key File Artefact
id: cd4ab3fa-f4ff-4634-9cf5-1ed76a8578bf
status: test
description: This rule identifies when a PsExec key file is created on a Windows host, matching filenames that start with C:\Windows\PSEXEC- and end with .key. Attackers commonly rely on PsExec-style remote execution, and the key file is written to the file system as part of command execution. The detection relies on file creation or file event telemetry that includes TargetFilename.
references:
- https://aboutdfir.com/the-key-to-identify-psexec/
- https://twitter.com/davisrichardg/status/1616518800584704028
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-01-21
modified: 2023-02-23
tags:
- attack.lateral-movement
- attack.privilege-escalation
- attack.execution
- attack.persistence
- attack.t1136.002
- attack.t1543.003
- attack.t1570
- attack.s0029
logsource:
category: file_event
product: windows
detection:
selection:
TargetFilename|startswith: C:\Windows\PSEXEC-
TargetFilename|endswith: .key
condition: selection
falsepositives:
- Unlikely
level: high
license: DRL-1.1
related:
- id: 304afd73-55a5-4bb9-8c21-0b1fc84ea9e4
type: derived