Detectionlowtest

PsExec Service File Creation

Detects default PsExec service filename which indicates PsExec service installation and execution

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Thomas PatzkeCreated Mon Jun 12Updated Wed Oct 26259e5a6a-b8d2-4c38-86e2-26c5e651361dwindows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|endswith: '\PSEXESVC.exe'
    condition: selection

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0002 · Execution

Sub-techniques

T1569.002 · Service Execution

Software

S0029 · S0029

Related Rules

DerivedDetectionmedium

PsExec Service Installation

Detects PsExec service installation and execution events

This rule was derived from the related rule - both detect similar activity with different scope.

Rule Metadata

Rule ID

259e5a6a-b8d2-4c38-86e2-26c5e651361d

Status

test

Level

low

Type

Detection

Created

Mon Jun 12

Modified

Wed Oct 26

Author

Thomas Patzke

Path

rules/windows/file/file_event/file_event_win_sysinternals_psexec_service.yml

Raw Tags

attack.executionattack.t1569.002attack.s0029

View on GitHub