Windows: PSEXESVC-Launched Child Process Running as LOCAL SYSTEM

Alerts when PSEXESVC spawns a child process running as LOCAL SYSTEM (AUTHORI/AUTORI) on the local host.

FreeUnreviewedSigmahighv1

windows-psexesvc-launched-child-process-running-as-local-system-7c0dcd3d

title: "Windows: PSEXESVC-Launched Child Process Running as LOCAL SYSTEM"
id: 4f92dfe4-959f-487a-93bd-a4cde23c4200
related:
  - id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba
    type: similar
  - id: 7c0dcd3d-acf8-4f71-9570-f448b0034f94
    type: derived
status: test
description: This rule flags process creation where the parent is C:\Windows\PSEXESVC.exe and the process runs under a LOCAL_SYSTEM account context (matched via the user name containing AUTHORI/AUTORI). Such behavior is significant because PsExec’s service execution can launch commands with the highest local privileges, enabling remote actions beyond the initiating user’s permissions. It relies on Windows process creation telemetry including the parent process image path and the account name associated with the spawned process.
references:
  - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-02-28
tags:
  - attack.execution
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage: C:\Windows\PSEXESVC.exe
    User|contains:
      - AUTHORI
      - AUTORI
  condition: selection
falsepositives:
  - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
level: high
license: DRL-1.1

What it detects

This rule flags process creation where the parent is C:\Windows\PSEXESVC.exe and the process runs under a LOCAL_SYSTEM account context (matched via the user name containing AUTHORI/AUTORI). Such behavior is significant because PsExec’s service execution can launch commands with the highest local privileges, enabling remote actions beyond the initiating user’s permissions. It relies on Windows process creation telemetry including the parent process image path and the account name associated with the spawned process.

Known false positives

Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.