PSexec Service Creation (Windows Event Log)

id: '5399.5499'
title: PSexec Service Creation
description: 'Detect creation of service for PSexec, as seen with Impackets PSexec.py
  or PSexec execution. -- Threat Actor Association: APT29, APT31, BlackMatter, DarkSide,
  Fox Kitten, Hello Kitty / Five Hands, Whisper Spider, UNC2628 -- Software Association:
  Akira, Conti, LockBit, Nefilim, Play, Rhysida, SamSam'
logic_format: Splunk
logic: '`get_endpoint_data` `get_endpoint_data_winevent` (TERM(EventCode=7045) OR
  "<EventID>7045<")| regex Service_Start_Type!="4|disabled"| regex Service_Name!="\s+|[\_\/\x5c]"|
  regex Service_Name="(\w{4}|execsvc)$"| regex Service_File_Name="\x5c.{8}\.exe$"
  | eval service_name=Service_File_Name | table _time, host, user signature_id, user,
  dest_host, process_id, process_name, process_path, process, parent_process_id, parent_process_name,
  parent_process_path, event_id, src, service_name | bin span=1s | stats values(*)
  as * by _time, host '
techniques:
- persistence:create or modify system process:windows service
- execution:system services:service execution
technique_id:
- T1543.003
- T1569.002
data_category:
- Windows event logs
references:
- https://github.com/SecureAuthCorp/impacket/blob/master/examples/psexec.py
- https://ashwinrayaprolu.wordpress.com/2011/04/12/xcmd-an-alternative-to-psexec/
- https://github.com/kavika13/RemCom
- https://github.com/malcomvetter/CSExec/tree/master/csexecsvc