Windows PUA CsExec Execution via Process Creation
Flags Windows process creation of csexec.exe (CsExec) consistent with remote execution tooling usage.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-08-22
- Updated
- 2026-07-30
ATT&CK techniques
Resource Dev → ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of the CsExec remote execution tool by matching process creation events for csexec.exe and descriptions containing "csexec". Attackers can use such tooling to execute commands on remote systems, blending into legitimate administrative workflows. The detection relies on Windows process creation telemetry, specifically the executable filename and the process description field.
Reporting behind it
- github.comhttps://github.com/malcomvetter/CSExec
- microsoft.comhttps://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_csexec.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PUA CsExec Execution via Process Creation
id: e621a4a1-e91d-4f8d-b5bc-01bad4dab6cd
status: test
description: This rule identifies execution of the CsExec remote execution tool by matching process creation events for csexec.exe and descriptions containing "csexec". Attackers can use such tooling to execute commands on remote systems, blending into legitimate administrative workflows. The detection relies on Windows process creation telemetry, specifically the executable filename and the process description field.
references:
- https://github.com/malcomvetter/CSExec
- https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_csexec.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2022-08-22
modified: 2023-02-21
tags:
- attack.resource-development
- attack.t1587.001
- attack.execution
- attack.t1569.002
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \csexec.exe
selection_pe:
Description: csexec
condition: 1 of selection*
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: d08a2711-ee8b-4323-bdec-b7d85e892b31
type: derived