detection.wiki

Detection rules › Sigma

PsExec Service File Creation

Status
test
Severity
low
Log source
category file_event, product windows
Author
Thomas Patzke
Source
github.com/SigmaHQ/sigma

Detects default PsExec service filename which indicates PsExec service installation and execution

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

ProviderRecord / event type
SysmonEvent ID 11: FileCreate

Rule body

title: PsExec Service File Creation
id: 259e5a6a-b8d2-4c38-86e2-26c5e651361d
related:
    - id: 42c575ea-e41e-41f1-b248-8093c3e82a28
      type: derived
status: test
description: Detects default PsExec service filename which indicates PsExec service installation and execution
references:
    - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
    - https://jpcertcc.github.io/ToolAnalysisResultSheet
author: Thomas Patzke
date: 2017-06-12
modified: 2022-10-26
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    category: file_event
    product: windows
detection:
    selection:
        TargetFilename|endswith: '\PSEXESVC.exe'
    condition: selection
falsepositives:
    - Unknown
level: low

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
    TargetFilename|endswith: '\PSEXESVC.exe'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
TargetFilenameends_with
  • \PSEXESVC.exe
field:"TargetFilename" kind:ends_with value:"\PSEXESVC.exe"