Windows Service Creation via SMB PsExec Using PSEXESVC (Event ID 4697)

title: Windows Service Creation via SMB PsExec Using PSEXESVC (Event ID 4697)
id: be45bd72-ebd6-4cf3-ab58-89f210db910d
related:
  - id: 1a17ce75-ff0d-4f02-9709-2b7bb5618cf0
    type: derived
  - id: 6fb63b40-e02a-403e-9ffd-3bcc1d749442
    type: derived
status: test
description: This rule flags Windows Security Event ID 4697 where a service is installed with on-demand start (ServiceStartType=3) and a service binary path that matches the SYSTEMROOT\########.exe pattern. It is aimed at service creation consistent with SMB PsExec-style execution, specifically filtering out entries for the service name PSEXESVC while matching other similarly shaped service names and binary names. The detection relies on the service installation audit telemetry from Windows Security logs (EID 4697) to observe the newly registered service, its filename, and startup configuration.
references:
  - https://bczyz1.github.io/2021/01/30/psexec.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml
author: Bartlomiej Czyz, Relativity, Huntrule Team
date: 2021-01-21
modified: 2022-10-05
tags:
  - attack.lateral-movement
  - attack.t1021.002
  - attack.t1570
  - attack.execution
  - attack.t1569.002
logsource:
  product: windows
  service: security
  definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
  selection:
    EventID: 4697
    ServiceFileName|re: ^%systemroot%\\[a-zA-Z]{8}\.exe$
    ServiceName|re: (^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$)
    ServiceStartType: 3
    ServiceType: "0x10"
  filter:
    ServiceName: PSEXESVC
  condition: selection and not filter
falsepositives:
  - Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name
level: high
license: DRL-1.1