PUA - CsExec Execution

Title: PUA - CsExec Execution
Status: test
Description:Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative
References:
  -https://github.com/malcomvetter/CSExec
  -https://www.microsoft.com/security/blog/2022/05/09/ransomware-as-a-service-understanding-the-cybercrime-gig-economy-and-how-to-protect-yourself/
Author: Florian Roth (Nextron Systems)
Date: 2022-08-22
modified:2023-02-21
Tags:

• -'attack.resource-development'
• -'attack.t1587.001'
• -'attack.execution'
• -'attack.t1569.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\csexec.exe'
  selection_pe:
    Description: 'csexec'
  condition:1 of selection*
Falsepositives:
  -Unknown
Level: high