Detectionmediumtest

PsExec Service Installation

Detects PsExec service installation and execution events

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Thomas PatzkeCreated Mon Jun 12Updated Fri Aug 0442c575ea-e41e-41f1-b248-8093c3e82a28windows

Log Source

Windowssystem

ProductWindows← raw: windows

Servicesystem← raw: system

Detection Logic

detection:
    selection_eid:
        Provider_Name: 'Service Control Manager'
        EventID: 7045
    selection_service:
        - ServiceName: 'PSEXESVC'
        - ImagePath|endswith: '\PSEXESVC.exe'
    condition: all of selection_*

False Positives

Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

References

MITRE ATT&CK

Tactics

TA0002 · Execution

Sub-techniques

T1569.002 · Service Execution

Software

S0029 · S0029

Rule Metadata

Rule ID

42c575ea-e41e-41f1-b248-8093c3e82a28

Status

test

Level

medium

Type

Detection

Created

Mon Jun 12

Modified

Fri Aug 04

Author

Thomas Patzke

Path

rules/windows/builtin/system/service_control_manager/win_system_service_install_sysinternals_psexec.yml

Raw Tags

attack.executionattack.t1569.002attack.s0029

View on GitHub