PSEXEC Remote Execution File Artefact

Title: PSEXEC Remote Execution File Artefact
Status: test
Description:Detects creation of the PSEXEC key file. Which is created anytime a PsExec command is executed. It gets written to the file system and will be recorded in the USN Journal on the target system
References:
  -https://aboutdfir.com/the-key-to-identify-psexec/
  -https://twitter.com/davisrichardg/status/1616518800584704028
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2023-01-21
modified:2023-02-23
Tags:

• -'attack.lateral-movement'
• -'attack.privilege-escalation'
• -'attack.execution'
• -'attack.persistence'
• -'attack.t1136.002'
• -'attack.t1543.003'
• -'attack.t1570'
• -'attack.s0029'

Logsource:

• category: file_event
• product: windows

Detection:
  selection:
    TargetFilename|startswith: 'C:\Windows\PSEXEC-'
    TargetFilename|endswith: '.key'
  condition:selection
Falsepositives:
  -Unlikely
Level: high