Windows PUA CsExec Execution via Process Creation

title: Windows PUA CsExec Execution via Process Creation
id: e621a4a1-e91d-4f8d-b5bc-01bad4dab6cd
status: test
description: This rule identifies execution of the CsExec remote execution tool by matching process creation events for csexec.exe and descriptions containing "csexec". Attackers can use such tooling to execute commands on remote systems, blending into legitimate administrative workflows. The detection relies on Windows process creation telemetry, specifically the executable filename and the process description field.
references:
  - https://github.com/malcomvetter/CSExec
  - https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_csexec.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-22
modified: 2023-02-21
tags:
  - attack.resource-development
  - attack.t1587.001
  - attack.execution
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \csexec.exe
  selection_pe:
    Description: csexec
  condition: 1 of selection*
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: d08a2711-ee8b-4323-bdec-b7d85e892b31
    type: derived