Windows PsExec Service Binary Renamed Execution via psexesvc.exe
Alerts when psexesvc.exe is executed from a non-standard path, suggesting renamed or relocated PsExec service usage.
FreeReviewedSigma · High · v1
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags process creation where the executable reports OriginalFileName as psexesvc.exe, but the launched image is not C:\Windows\PSEXESVC.exe. Renamed or relocated service binaries are a common way to evade allowlists and blend into unusual execution paths, so this pattern can indicate attacker-controlled execution. The detection relies on Windows process creation telemetry including OriginalFileName and the full Image path.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-psexec-service-binary-renamed-execution-via-psexesvc-exe-51ae86a2
title: Windows PsExec Service Binary Renamed Execution via psexesvc.exe
id: a16f45e1-a246-414c-8470-fd6e91881434
status: test
description: This rule flags process creation where the executable reports OriginalFileName as psexesvc.exe, but the launched image is not C:\Windows\PSEXESVC.exe. Renamed or relocated service binaries are a common way to evade allowlists and blend into unusual execution paths, so this pattern can indicate attacker-controlled execution. The detection relies on Windows process creation telemetry including OriginalFileName and the full Image path.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- https://www.youtube.com/watch?v=ro2QuZTIMBM
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_sysinternals_psexec_service.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-21
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
OriginalFileName: psexesvc.exe
filter:
Image: C:\Windows\PSEXESVC.exe
condition: selection and not filter
falsepositives:
- Legitimate administrative tasks
level: high
license: DRL-1.1
related:
- id: 51ae86a2-e2e1-4097-ad85-c46cb6851de4
type: derived