huntrule

Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket

Alerts on Windows Event ID 4697 service installs matching SYSTEMROOT\8char.exe and on-demand start, consistent with PsExec-style SMB execution.

FreeReviewedSigma · High · v2
Product
windows
Service
security
Author
Bartlomiej Czyz, Relativity (SigmaHQ), DRL 1.1
Published
2021-01-21
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Execution → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows service creation events (System Security Extension) where a service is installed with a service binary path under %systemroot% and an on-demand start type. It specifically targets service install patterns commonly used by SMB-based PsExec tooling associated with Metasploit’s exploit/windows/smb/psexec and Impacket’s psexec.py, while excluding services named PSEXESVC. The detection relies on Security Event ID 4697 telemetry, including ServiceFileName, ServiceName, ServiceStartType, and ServiceType fields.

Reporting behind it

Related detections9 linkedT1021.002 — drag to rearrange
Windows rundll32.exe execution with no parameters or arguments
Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)
Malicious Remote Process Execution From an SMB Admin Share (via process_creation)
Malicious PsExec Service Installation via PSEXESVC
Suspicious Lateral Movement via PsExec Service (via process_creation)
Possible PsExec Remote Service Installation with Randomly Named Service (via security)
Suspicious PsExec Copying Payload To Windows Temp (via process_creation)
Windows Named Pipe Creation: Default RemCom Pipe Name
Windows Named Pipe Created for CSExec Default Pipe Name
Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket
Pivot detection · T1021.002 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.