Title:
Renamed PAExec Execution
Status:
test
Description:Detects execution of renamed version of PAExec. Often used by attackers
References:
-https://www.poweradmin.com/paexec/
-https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf
Author: Florian Roth (Nextron Systems), Jason Lynch
Date: 2021-05-22
modified:2024-11-23
Tags:
- -'attack.stealth'
- -'attack.t1202'
Logsource:
- category: process_creation
- product: windows
Detection:
selection:
Description:
'PAExec Application'
OriginalFileName:
'PAExec.exe'
Product|contains:
'PAExec'
- Hashes|contains:
- 'IMPHASH=11D40A7B7876288F919AB819CC2D9802'
- 'IMPHASH=6444f8a34e99b8f7d9647de66aabe516'
- 'IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f'
- 'IMPHASH=1a6cca4d5460b1710a12dea39e4a592c'
filter_main_known_location:
Image|endswith:
'\paexec.exe'
Image|startswith:
'C:\Windows\PAExec-'
condition:
selection and not 1 of filter_main_*
Falsepositives:
-Weird admins that rename their tools
-Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing
-When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]"
Level:
high
