Windows PsExec Named Pipe Creation from Suspicious Paths (PSEXESVC)
Alerts on PsExec pipe \PSEXESVC creation when the executing image path is in public/temp/desktop/downloads locations.
- Product
- windows
- Category
- pipe_created
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-04
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags PsExec service named pipe creation events where the creating executable path contains common user-writable or staging locations such as \:\Users\Public\, \:\Windows\Temp\, \AppData\Local\Temp\, \Desktop\, or \Downloads\, and the pipe name matches \PSEXESVC. Attackers often stage tools in writable directories and then execute them to establish remote execution capabilities via the PsExec service. It relies on telemetry for named pipe creation events that include both the PipeName and the Image path of the process creating the pipe.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PsExec Named Pipe Creation from Suspicious Paths (PSEXESVC)
id: 668d012c-9d9f-4634-a21a-243c4d323b70
related:
- id: f3f3a972-f982-40ad-b63c-bca6afdfad7c
type: derived
- id: 41504465-5e3a-4a5b-a5b4-2a0baadd4463
type: derived
status: test
description: This rule flags PsExec service named pipe creation events where the creating executable path contains common user-writable or staging locations such as \:\Users\Public\, \:\Windows\Temp\, \AppData\Local\Temp\, \Desktop\, or \Downloads\, and the pipe name matches \PSEXESVC. Attackers often stage tools in writable directories and then execute them to establish remote execution capabilities via the PsExec service. It relies on telemetry for named pipe creation events that include both the PipeName and the Image path of the process creating the pipe.
references:
- https://www.jpcert.or.jp/english/pub/sr/ir_research.html
- https://jpcertcc.github.io/ToolAnalysisResultSheet
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-04
modified: 2023-09-20
tags:
- attack.execution
- attack.t1569.002
- attack.s0029
logsource:
category: pipe_created
product: windows
definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
selection:
PipeName: \PSEXESVC
Image|contains:
- :\Users\Public\
- :\Windows\Temp\
- \AppData\Local\Temp\
- \Desktop\
- \Downloads\
condition: selection
falsepositives:
- Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment.
level: medium
license: DRL-1.1