Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket
Alerts on Windows Event ID 4697 service installs matching SYSTEMROOT\8char.exe and on-demand start, consistent with PsExec-style SMB execution.
- Product
- windows
- Service
- security
- Author
- Bartlomiej Czyz, Relativity (SigmaHQ), DRL 1.1
- Published
- 2021-01-21
- Updated
- 2026-07-31
ATT&CK techniques
Execution → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows service creation events (System Security Extension) where a service is installed with a service binary path under %systemroot% and an on-demand start type. It specifically targets service install patterns commonly used by SMB-based PsExec tooling associated with Metasploit’s exploit/windows/smb/psexec and Impacket’s psexec.py, while excluding services named PSEXESVC. The detection relies on Security Event ID 4697 telemetry, including ServiceFileName, ServiceName, ServiceStartType, and ServiceType fields.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Service Installation (EID 4697) for SMB PsExec by Metasploit or Impacket
id: be45bd72-ebd6-4cf3-ab58-89f210db910d
related:
- id: 1a17ce75-ff0d-4f02-9709-2b7bb5618cf0
type: derived
- id: 6fb63b40-e02a-403e-9ffd-3bcc1d749442
type: derived
status: test
description: This rule flags Windows service creation events (System Security Extension) where a service is installed with a service binary path under %systemroot% and an on-demand start type. It specifically targets service install patterns commonly used by SMB-based PsExec tooling associated with Metasploit’s exploit/windows/smb/psexec and Impacket’s psexec.py, while excluding services named PSEXESVC. The detection relies on Security Event ID 4697 telemetry, including ServiceFileName, ServiceName, ServiceStartType, and ServiceType fields.
references:
- https://bczyz1.github.io/2021/01/30/psexec.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml
author: Bartlomiej Czyz, Relativity, Huntrule Team
date: 2021-01-21
modified: 2022-10-05
tags:
- attack.lateral-movement
- attack.t1021.002
- attack.t1570
- attack.execution
- attack.t1569.002
logsource:
product: windows
service: security
definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697
detection:
selection:
EventID: 4697
ServiceFileName|re: ^%systemroot%\\[a-zA-Z]{8}\.exe$
ServiceName|re: (^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$)
ServiceStartType: 3
ServiceType: "0x10"
filter:
ServiceName: PSEXESVC
condition: selection and not filter
falsepositives:
- Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name
level: high
license: DRL-1.1