CSExec Service Installation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•29

Detects the installation and execution of the 'csexecsvc' service, which is associated with the CSExec tool. This rule specifically looks for Event ID 7045 from the 'Service Control Manager' provider, indicating a service installation, and correlates it with the service name 'csexecsvc' or an image path ending with '\csexecsvc.exe'.