Windows PsExec Service File Creation via PSEXESVC.exe

title: Windows PsExec Service File Creation via PSEXESVC.exe
id: 83582057-01a0-4bcd-8d59-96344dbb2846
related:
  - id: 42c575ea-e41e-41f1-b248-8093c3e82a28
    type: derived
  - id: 259e5a6a-b8d2-4c38-86e2-26c5e651361d
    type: derived
status: test
description: This rule identifies file creation events where the target filename ends with \PSEXESVC.exe, a default component filename associated with PsExec service installation and execution. Attackers may use PsExec to execute commands remotely by deploying a service, making this artifact a useful signal for lateral movement and remote execution. The detection relies on Windows file event telemetry that records the created/observed target filename.
references:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml
author: Thomas Patzke, Huntrule Team
date: 2017-06-12
modified: 2022-10-26
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
logsource:
  category: file_event
  product: windows
detection:
  selection:
    TargetFilename|endswith: \PSEXESVC.exe
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1