Suspicious PsExec Execution

Title: Suspicious PsExec Execution
Status: test
Description:detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
References:
  -https://web.archive.org/web/20230329171218/https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html
Author: Samir Bousseaden
Date: 2019-04-03
modified:2022-08-11
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• product: windows
• service: security
• definition: The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure

Detection:
  selection1:
    EventID: '5145'
    ShareName: '\\\\\*\\IPC$'
    RelativeTargetName|endswith:
      -'-stdin'
      -'-stdout'
      -'-stderr'

  filter:
    RelativeTargetName|startswith: 'PSEXESVC'
  condition:selection1 and not filter
Falsepositives:
  -Unknown
Level: high