huntrule

Windows Service Control Manager Detects CSExecSvc Installation and Execution

Flags Windows service creation for csexecsvc with image path ending in \csexecsvc.exe via Service Control Manager (7045).

FreeReviewedSigma · Medium · v2
Product
windows
Service
system
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2023-08-07
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies attempts to install the CSExec Windows service by matching Service Control Manager events where the service name is csexecsvc and the ImagePath ends with \csexecsvc.exe. Service installation followed by execution is a common method for attackers to gain persistent or remote execution capabilities. It relies on Windows System telemetry from Event ID 7045, including Provider_Name, ServiceName, and ImagePath fields.

Reporting behind it

Related detections9 linkedT1569.002 — drag to rearrange
PsExec Remote Service Execution on Target Host (via process_creation)
Renamed Procdump Tool Used for Dumping LSASS Process (via process_creation)
Suspicious Service Installation Masquerading as winupd
Suspicious PSexec Application Execution (via process_creation)
Malicious Metasploit PsExec Named Pipe Command Execution
Malicious PsExec Service Installation via PSEXESVC
Malicious NotPetya Payload Execution via Rundll32 Ordinal Export from Windows Directory
Suspicious Lateral Movement via PsExec Service (via process_creation)
Possible PsExec Remote Service Installation with Randomly Named Service (via security)
Windows Service Control Manager Detects CSExecSvc Installation and Execution
Pivot detection · T1569.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.