Detection rules › Sigma

PsExec Service Child Process Execution as LOCAL SYSTEM

Severity
high
Author
Florian Roth (Nextron Systems)
Source
upstream

Detects suspicious launch of the PSEXESVC service on this system and a sub process run as LOCAL_SYSTEM (-s), which means that someone remotely started a command on this system running it with highest privileges and not only the privileges of the login user account (e.g. the administrator account)

Event coverage

ProviderEvent IDTitle
Sysmon1Process creation
Security-Auditing4688A new process has been created.

Stages and Predicates

Stage 1: selection

or:
User|contains: AUTHORI
User|contains: AUTORI
ParentImage: 'C:\Windows\PSEXESVC.exe'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
ParentImageeq
  • C:\Windows\PSEXESVC.exe
Usermatch
  • AUTHORI corpus 16 (sigma 16)
  • AUTORI corpus 16 (sigma 16)