Impacket PsExec Execution

Title: Impacket PsExec Execution
Status: test
Description:Detects execution of Impacket's psexec.py.
References:
  -https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html
Author: Bhabesh Raj
Date: 2020-12-14
modified:2022-09-22
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• product: windows
• service: security
• definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Detection:
  selection1:
    EventID: '5145'
    ShareName: '\\\\\*\\IPC$'
    RelativeTargetName|contains:
      -'RemCom_stdin'
      -'RemCom_stdout'
      -'RemCom_stderr'

  condition:selection1
Falsepositives:
  -Unknown
Level: high