detection.wiki

Detection rules › Sigma

PsExec Service Installation

Status
test
Severity
medium
Log source
product windows, service system
Author
Thomas Patzke
Source
github.com/SigmaHQ/sigma

Detects PsExec service installation and execution events

MITRE ATT&CK coverage

TacticTechniques
Execution

Telemetry coverage

ProviderRecord / event type
Service-Control-ManagerEvent ID 7045: A service was installed in the system.

Rule body

title: PsExec Service Installation
id: 42c575ea-e41e-41f1-b248-8093c3e82a28
status: test
description: Detects PsExec service installation and execution events
references:
    - https://www.jpcert.or.jp/english/pub/sr/ir_research.html
    - https://jpcertcc.github.io/ToolAnalysisResultSheet
author: Thomas Patzke
date: 2017-06-12
modified: 2023-08-04
tags:
    - attack.execution
    - attack.t1569.002
    - attack.s0029
logsource:
    product: windows
    service: system
detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ServiceName: 'PSEXESVC'
        - ImagePath|endswith: '\PSEXESVC.exe'
    condition: all of selection_*
falsepositives:
    - Unknown
level: medium

Stages and Predicates

Stage 0: condition

all of selection_*

Stage 1: selection_eid

selection_eid:
    Provider_Name: 'Service Control Manager'
    EventID: 7045

Stage 2: selection_service

selection_service:
    - ServiceName: 'PSEXESVC'
    - ImagePath|endswith: '\PSEXESVC.exe'

Indicators

These rows show field, operator, and value matches.

FieldKindValuesSearch
ImagePathends_with
  • \PSEXESVC.exe
field:"ImagePath" kind:ends_with value:"\PSEXESVC.exe"
Provider_Nameeq
  • Service Control Manager corpus 50 (sigma 50)
field:"Provider_Name" kind:eq value:"Service Control Manager"
ServiceNameeq
  • PSEXESVC
field:"ServiceName" kind:eq value:"PSEXESVC"