Windows PsExec Service Binary Renamed Execution via psexesvc.exe

Alerts when psexesvc.exe is executed from a non-standard path, suggesting renamed or relocated PsExec service usage.

FreeUnreviewedSigmahighv1

windows-psexec-service-binary-renamed-execution-via-psexesvc-exe-51ae86a2

title: Windows PsExec Service Binary Renamed Execution via psexesvc.exe
id: a16f45e1-a246-414c-8470-fd6e91881434
status: test
description: This rule flags process creation where the executable reports OriginalFileName as psexesvc.exe, but the launched image is not C:\Windows\PSEXESVC.exe. Renamed or relocated service binaries are a common way to evade allowlists and blend into unusual execution paths, so this pattern can indicate attacker-controlled execution. The detection relies on Windows process creation telemetry including OriginalFileName and the full Image path.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.youtube.com/watch?v=ro2QuZTIMBM
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-21
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    OriginalFileName: psexesvc.exe
  filter:
    Image: C:\Windows\PSEXESVC.exe
  condition: selection and not filter
falsepositives:
  - Legitimate administrative tasks
level: high
license: DRL-1.1
related:
  - id: 51ae86a2-e2e1-4097-ad85-c46cb6851de4
    type: derived

What it detects

This rule flags process creation where the executable reports OriginalFileName as psexesvc.exe, but the launched image is not C:\Windows\PSEXESVC.exe. Renamed or relocated service binaries are a common way to evade allowlists and blend into unusual execution paths, so this pattern can indicate attacker-controlled execution. The detection relies on Windows process creation telemetry including OriginalFileName and the full Image path.

Known false positives

Legitimate administrative tasks

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.