Detection rules › Sigma

Suspicious PsExec Execution

Severity
high
Author
Samir Bousseaden
Source
upstream

detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one

MITRE ATT&CK coverage

TacticTechniques
Lateral MovementT1021.002 Remote Services: SMB/Windows Admin Shares

Event coverage

ProviderEvent IDTitle
Security-Auditing5145A network share object was checked to see whether client can be granted desired access.

Stages and Predicates

Stage 1: selection1

or:
RelativeTargetName|endswith: -stderr
RelativeTargetName|endswith: -stdin
RelativeTargetName|endswith: -stdout
ShareName: '\\\\\*\\IPC$'

Stage 2: not filter

RelativeTargetName|startswith: PSEXESVC

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
RelativeTargetNameends_with
  • -stderr
  • -stdin
  • -stdout
RelativeTargetNamestarts_with
  • PSEXESVC
ShareNameeq
  • \\\\\*\\IPC$ corpus 6 (sigma 6)

Neighbors

Broader alternatives (more inclusive than this rule)

These rules match a superset of what this rule catches. They cover the same events plus more. Use them if you want wider coverage and can absorb more false positives.