PsExec Service Child Process Execution as LOCAL SYSTEM

Status: test
Severity: high
Log source: category process_creation, product windows
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

Known false positives

Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension

MITRE ATT&CK coverage

Tactic	Techniques
Execution	No specific technique

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation
Security-Auditing	Event ID 4688: A new process has been created.

Rule body

title: PsExec Service Child Process Execution as LOCAL SYSTEM
id: 7c0dcd3d-acf8-4f71-9570-f448b0034f94
related:
    - id: fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba
      type: similar
status: test
description: Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)
references:
    - https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
author: Florian Roth (Nextron Systems)
date: 2022-07-21
modified: 2023-02-28
tags:
    - attack.execution
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        ParentImage: 'C:\Windows\PSEXESVC.exe'
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection
falsepositives:
    - Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
level: high

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    ParentImage: 'C:\Windows\PSEXESVC.exe'
    User|contains:
        - 'AUTHORI'
        - 'AUTORI'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ParentImage`	eq	`C:\Windows\PSEXESVC.exe`	`field:"ParentImage" kind:eq value:"C:\Windows\PSEXESVC.exe"`
`User`	match	`AUTHORI` corpus 14 (sigma 14) `AUTORI` corpus 14 (sigma 14)	`field:"user" kind:match`