PSexec service installation

Status: experimental
Severity: medium
Log source: product windows, service ['system', 'security']
Author: mdecrevoisier
Source: github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker installs PSexec service.

Known false positives

Administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1543.003` Create or Modify System Process: Windows Service
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service

Telemetry coverage

Provider	Record / event type
Security-Auditing	Event ID 4674: An operation was attempted on a privileged object.
Security-Auditing	Event ID 4697: A service was installed in the system.
Service-Control-Manager	Event ID 7045: A service was installed in the system.

Rule body

title: PSexec service installation
description: Detects scenarios where an attacker installs PSexec service.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1543.003-Create%20or%20Modify%20System%20Process-Windows%20Service
- https://attack.mitre.org/software/S0029/
- https://pentera.io/blog/135-is-the-new-145/
- https://nv2lt.github.io/windows/smb-psexec-smbexec-winexe-how-to/
- https://www.synacktiv.com/publications/traces-of-windows-remote-command-execution.html
tags:
- attack.privilege_execution
- attack.t1543.003
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  service: 
    - system
    - security
detection:
  selection_service_install:
    EventID:
      - 4697 # SECURITY logs: new service
      - 7045 # SYSTEM logs: new service
    ServiceName|contains: PSEXESVC

  selection_service_privilege:
    EventID: 4674
    ObjectServer: 'SC Manager'
    ProcessName|endswith: '\services.exe' # full path 'C:\Windows\System32\services.exe'
    ObjectName: PSEXESVC

  condition: selection_service_install or selection_service_privilege
falsepositives:
- Administrator activity
level: medium

Stages and Predicates

Stage 0: `condition`

selection_service_install or selection_service_privilege

Stage 1: `selection_service_install`

selection_service_install:
  EventID:
    - 4697
    - 7045
  ServiceName|contains: PSEXESVC

Stage 2: `selection_service_privilege`

selection_service_privilege:
  EventID: 4674
  ObjectServer: 'SC Manager'
  ProcessName|endswith: '\services.exe'
  ObjectName: PSEXESVC

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`ObjectName`	eq	`PSEXESVC`	`field:"ObjectName" kind:eq value:"PSEXESVC"`
`ObjectServer`	eq	`SC Manager` corpus 2 (sigma 1, kusto 1)	`field:"ObjectServer" kind:eq value:"SC Manager"`
`ProcessName`	ends_with	`\services.exe`	`field:"process_name" kind:ends_with value:"\services.exe"`
`ServiceName`	match	`PSEXESVC`	`field:"ServiceName" kind:match value:"PSEXESVC"`

PSexec service installation

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_service_install

Stage 2: selection_service_privilege

Indicators

Stage 0: `condition`

Stage 1: `selection_service_install`

Stage 2: `selection_service_privilege`