Windows PsExec Named Pipe Creation from Suspicious Image Locations (PipeName \PSEXESVC)

Alerts on PsExec pipe \PSEXESVC creation when the executing image path is in public/temp/desktop/downloads locations.

FreeUnreviewedSigmamediumv1

windows-psexec-named-pipe-creation-from-suspicious-image-locations-pipename-psex-41504465

title: Windows PsExec Named Pipe Creation from Suspicious Image Locations (PipeName \PSEXESVC)
id: 668d012c-9d9f-4634-a21a-243c4d323b70
related:
  - id: f3f3a972-f982-40ad-b63c-bca6afdfad7c
    type: derived
  - id: 41504465-5e3a-4a5b-a5b4-2a0baadd4463
    type: derived
status: test
description: This rule flags PsExec default named pipe creation when the process image path contains one of several commonly abused user or temporary directories. Attackers often place or run tools from locations like \Users\Public, Temp, AppData\Local\Temp, Desktop, or Downloads to evade scrutiny and blend into normal activity. The detection relies on named pipe creation events that include both the PipeName and the executing Image path.
references:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/pipe_created/pipe_created_sysinternals_psexec_default_pipe_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-08-04
modified: 2023-09-20
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
logsource:
  category: pipe_created
  product: windows
  definition: Note that you have to configure logging for Named Pipe Events in Sysmon config (Event ID 17 and Event ID 18). The basic configuration is in popular sysmon configuration (https://github.com/SwiftOnSecurity/sysmon-config), but it is worth verifying. You can also use other repo, e.g. https://github.com/Neo23x0/sysmon-config, https://github.com/olafhartong/sysmon-modular. How to test detection? You can check powershell script from this site https://svch0st.medium.com/guide-to-named-pipes-and-hunting-for-cobalt-strike-pipes-dc46b2c5f575
detection:
  selection:
    PipeName: \PSEXESVC
    Image|contains:
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \Desktop\
      - \Downloads\
  condition: selection
falsepositives:
  - Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment.
level: medium
license: DRL-1.1

What it detects

This rule flags PsExec default named pipe creation when the process image path contains one of several commonly abused user or temporary directories. Attackers often place or run tools from locations like \Users\Public, Temp, AppData\Local\Temp, Desktop, or Downloads to evade scrutiny and blend into normal activity. The detection relies on named pipe creation events that include both the PipeName and the executing Image path.

Known false positives

Rare legitimate use of psexec from the locations mentioned above. This will require initial tuning based on your environment.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.