Impacket PsExec Execution via IPC$ Share

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•88

Detects the execution of Impacket's psexec.py by monitoring for specific file share access patterns on the IPC$ share. The rule looks for EventID 5145 (a detailed file share access event) where the ShareName is '\\*\IPC$' and the RelativeTargetName contains 'RemCom_stdin', 'RemCom_stdout', or 'RemCom_stderr'. These file names are characteristic of how Impacket's psexec.py communicates with the remote service.