Phoenix
Sigma IntelligenceBeta
Back to Rules
Detectionhightest

PsExec Service Child Process Execution as LOCAL SYSTEM

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Florian Roth (Nextron Systems)Created Thu Jul 21Updated Tue Feb 287c0dcd3d-acf8-4f71-9570-f448b0034f94windows
Log Source
WindowsProcess Creation
ProductWindows← raw: windows
CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        ParentImage: 'C:\Windows\PSEXESVC.exe'
        User|contains: # covers many language settings
            - 'AUTHORI'
            - 'AUTORI'
    condition: selection
False Positives

Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension

References
1
Resolving title…
learn.microsoft.com
MITRE ATT&CK
Related Rules
Similar

fa91cc36-24c9-41ce-b3c8-3bbc3f2f67ba

Rule not found
Rule Metadata
Rule ID
7c0dcd3d-acf8-4f71-9570-f448b0034f94
Status
test
Level
high
Type
Detection
Created
Thu Jul 21
Modified
Tue Feb 28
Author
Florian Roth (Nextron Systems)
Path
rules/windows/process_creation/proc_creation_win_sysinternals_psexesvc_as_system.yml
Raw Tags
attack.execution
View on GitHub