Windows PsExec Service Execution via PSEXESVC.exe
Detects PsExec service execution by matching the PSEXESVC.exe process on Windows.
FreeReviewedSigma · Medium · v1
- Product
- windows
- Category
- process_creation
- Author
- Thomas Patzke, Romaissa Adjailia, Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2017-06-12
- Updated
- 2026-07-30
What it detects
This rule flags process creation where C:\Windows\PSEXESVC.exe runs, corresponding to use of the PsExec service component for remote execution. Attackers can leverage this to execute commands on a remote Windows host in a way that blends into administrative tooling. Telemetry relies on Windows process creation events capturing the full image path and the OriginalFileName field.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-psexec-service-execution-via-psexesvc-exe-fdfcbd78
title: Windows PsExec Service Execution via PSEXESVC.exe
id: fba8085e-6371-47d5-b5f8-3fd01c015e33
related:
- id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba
type: obsolete
- id: fdfcbd78-48f1-4a4b-90ac-d82241e368c5
type: derived
status: test
description: This rule flags process creation where C:\Windows\PSEXESVC.exe runs, corresponding to use of the PsExec service component for remote execution. Attackers can leverage this to execute commands on a remote Windows host in a way that blends into administrative tooling. Telemetry relies on Windows process creation events capturing the full image path and the OriginalFileName field.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- https://www.youtube.com/watch?v=ro2QuZTIMBM
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc.yml
author: Thomas Patzke, Romaissa Adjailia, Florian Roth (Nextron Systems), Huntrule Team
date: 2017-06-12
modified: 2023-02-28
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
- Image: C:\Windows\PSEXESVC.exe
- OriginalFileName: psexesvc.exe
condition: selection
falsepositives:
- Legitimate administrative tasks
level: medium
license: DRL-1.1