Detectionmediumtest
Sysinternals PsService Execution
Detects usage of Sysinternals PsService which can be abused for service reconnaissance and tampering
Convert In Phoenix Studio
Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.
Launch
Nasreddine Bencherchali (Nextron Systems)Created Thu Jun 16Updated Fri Feb 243371f518-5fe3-4cf6-a14b-2a0ae3fd8a4fwindows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation
Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.
Detection Logic
Detection Logic1 selector
detection:
selection:
- OriginalFileName: 'psservice.exe'
- Image|endswith:
- '\PsService.exe'
- '\PsService64.exe'
condition: selectionFalse Positives
Legitimate use of PsService by an administrator
References
MITRE ATT&CK
Rule Metadata
Rule ID
3371f518-5fe3-4cf6-a14b-2a0ae3fd8a4f
Status
test
Level
medium
Type
Detection
Created
Thu Jun 16
Modified
Fri Feb 24
Path
rules/windows/process_creation/proc_creation_win_sysinternals_psservice.yml
Raw Tags
attack.privilege-escalationattack.discoveryattack.persistenceattack.t1543.003