Detectionhightest

PSEXEC Remote Execution File Artefact

Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Nasreddine Bencherchali (Nextron Systems)Created Sat Jan 21Updated Thu Feb 23304afd73-55a5-4bb9-8c21-0b1fc84ea9e4windows

Log Source

WindowsFile Event

ProductWindows← raw: windows

CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic

detection:
    selection:
        TargetFilename|startswith: 'C:\Windows\PSEXEC-'
        TargetFilename|endswith: '.key'
    condition: selection

False Positives

Unlikely

False positives are unlikely for most environments. High confidence detection.

References

MITRE ATT&CK

Tactics

TA0008 · Lateral Movement TA0004 · Privilege Escalation TA0002 · Execution TA0003 · Persistence

Techniques

T1570 · Lateral Tool Transfer

Sub-techniques

T1136.002 · Domain Account T1543.003 · Windows Service

Software

S0029 · S0029

Rule Metadata

Rule ID

304afd73-55a5-4bb9-8c21-0b1fc84ea9e4

Status

test

Level

high

Type

Detection

Created

Sat Jan 21

Modified

Thu Feb 23

Author

Nasreddine Bencherchali (Nextron Systems)

Path

rules/windows/file/file_event/file_event_win_sysinternals_psexec_service_key.yml

Raw Tags

attack.lateral-movementattack.privilege-escalationattack.executionattack.persistenceattack.t1136.002attack.t1543.003attack.t1570attack.s0029

View on GitHub