Windows: PSEXESVC-Launched Child Process Running as LOCAL SYSTEM
Alerts when PSEXESVC spawns a child process running as LOCAL SYSTEM (AUTHORI/AUTORI) on the local host.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-07-21
- Updated
- 2026-07-30
What it detects
This rule flags process creation where the parent is C:\Windows\PSEXESVC.exe and the process runs under a LOCAL_SYSTEM account context (matched via the user name containing AUTHORI/AUTORI). Such behavior is significant because PsExec’s service execution can launch commands with the highest local privileges, enabling remote actions beyond the initiating user’s permissions. It relies on Windows process creation telemetry including the parent process image path and the account name associated with the spawned process.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows: PSEXESVC-Launched Child Process Running as LOCAL SYSTEM"
id: 4f92dfe4-959f-487a-93bd-a4cde23c4200
related:
- id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba
type: similar
- id: 7c0dcd3d-acf8-4f71-9570-f448b0034f94
type: derived
status: test
description: This rule flags process creation where the parent is C:\Windows\PSEXESVC.exe and the process runs under a LOCAL_SYSTEM account context (matched via the user name containing AUTHORI/AUTORI). Such behavior is significant because PsExec’s service execution can launch commands with the highest local privileges, enabling remote actions beyond the initiating user’s permissions. It relies on Windows process creation telemetry including the parent process image path and the account name associated with the spawned process.
references:
- https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-07-21
modified: 2023-02-28
tags:
- attack.execution
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage: C:\Windows\PSEXESVC.exe
User|contains:
- AUTHORI
- AUTORI
condition: selection
falsepositives:
- Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
level: high
license: DRL-1.1