smbexec.py Service Installation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•24

Detects the installation of a service by the smbexec.py tool, identified by a specific service name ('BTOBTO') and characteristic command-line arguments in the ImagePath, which typically involve executing a batch script and redirecting output.