Windows PsExec Service Execution via PSEXESVC.exe

Detects PsExec service execution by matching the PSEXESVC.exe process on Windows.

FreeUnreviewedSigmamediumv1

windows-psexec-service-execution-via-psexesvc-exe-fdfcbd78

title: Windows PsExec Service Execution via PSEXESVC.exe
id: fba8085e-6371-47d5-b5f8-3fd01c015e33
related:
  - id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba
    type: obsolete
  - id: fdfcbd78-48f1-4a4b-90ac-d82241e368c5
    type: derived
status: test
description: This rule flags process creation where C:\Windows\PSEXESVC.exe runs, corresponding to use of the PsExec service component for remote execution. Attackers can leverage this to execute commands on a remote Windows host in a way that blends into administrative tooling. Telemetry relies on Windows process creation events capturing the full image path and the OriginalFileName field.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://www.youtube.com/watch?v=ro2QuZTIMBM
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml
author: Thomas Patzke, Romaissa Adjailia, Florian Roth (Nextron Systems), Huntrule Team
date: 2017-06-12
modified: 2023-02-28
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image: C:\Windows\PSEXESVC.exe
    - OriginalFileName: psexesvc.exe
  condition: selection
falsepositives:
  - Legitimate administrative tasks
level: medium
license: DRL-1.1

What it detects

This rule flags process creation where C:\Windows\PSEXESVC.exe runs, corresponding to use of the PsExec service component for remote execution. Attackers can leverage this to execute commands on a remote Windows host in a way that blends into administrative tooling. Telemetry relies on Windows process creation events capturing the full image path and the OriginalFileName field.

Known false positives

Legitimate administrative tasks

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.