Metasploit Or Impacket Service Installation Via SMB PsExec
Detects the installation of services that are characteristic of Metasploit's SMB PsExec module (exploit/windows/smb/psexec) and Impacket's psexec.py. The rule specifically looks for Windows Security Event ID 4697 (A service was installed in the system) where the ServiceFileName matches a pattern of '%systemroot%\<8_random_chars>.exe' and the ServiceName matches a pattern of 4, 8, or 16 alphabetic characters, while excluding the known legitimate 'PSEXESVC' service.
Sigma
