Windows PsExec Service Installation via Service Control Manager (Event ID 7045)

title: Windows PsExec Service Installation via Service Control Manager (Event ID 7045)
id: 4dbdbbf8-d633-4c2b-b9a2-12c83c81eaff
status: test
description: This rule matches Windows Service Control Manager events indicating a new service was installed with the service name PSEXESVC and an image path ending in \PSEXESVC.exe. Such service creation can be abused to execute remote tooling in the context of the Windows service control workflow. Detection relies on System logs recording Event ID 7045, including Provider_Name, ServiceName, and ImagePath.
references:
  - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  - https://jpcertcc.github.io/ToolAnalysisResultSheet
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml
author: Thomas Patzke, Huntrule Team
date: 2017-06-12
modified: 2023-08-04
tags:
  - attack.execution
  - attack.t1569.002
  - attack.s0029
logsource:
  product: windows
  service: system
detection:
  selection_eid:
    Provider_Name: Service Control Manager
    EventID: 7045
  selection_service:
    - ServiceName: PSEXESVC
    - ImagePath|endswith: \PSEXESVC.exe
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 42c575ea-e41e-41f1-b248-8093c3e82a28
    type: derived