Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
71
42
12
10
8
Contributors
43
35
20
13
7
Categories
85
60
25
14
12
Platforms
151
4
Products / Services
36
36
27
21
12
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
IDS Classtypes
8
2
IDS Protocols
12
Detects the creation of services or remote execution indicative of PsExec usage over SMB administrative shares. This behavior is commonly associated with lateral movement techniques used by threat groups such as Black Basta (Storm-1811) to execute payloads on remote systems.
Detects the use of PsExec or SC.exe to create services on multiple remote endpoints within a short time window. This pattern is characteristic of adversary-driven mass deployment of ransomware or other malicious payloads where remote execution via Windows service control is used to move laterally across a network.
Detects potential lateral movement by monitoring for the creation of services associated with PsExec (e.g., PSEXESVC or ADMIN$ share usage), followed by a network connection over SMB (port 445) and the subsequent execution of the corresponding remote process.
Detects lateral movement patterns associated with PsExec or its variants. The rule correlates SMB administrative share access (ADMIN$ or IPC$), the subsequent installation of a service (often named PSEXESVC or using a temporary executable path), and the immediate execution of a command or shell (cmd.exe or powershell.exe) by that service.
Detects the execution of PsExec by identifying the creation of the PSEXESVC remote service or its associated named pipe. It also identifies renamed or masqueraded PsExec binaries by checking file metadata and provides a mechanism to flag unusual source-to-target host account pairings often associated with lateral movement via SMB/Admin Shares.
This rule detects potential lateral movement activity by identifying the execution of PsExec service components or common lateral movement tools (PsExec, WMIC, CMD) interacting with Windows administrative shares (via UNC paths or specific network ports 135, 139, 445). It specifically looks for process creation events associated with these tools and network activity indicative of remote administration. Legitimate administrative tools signed by Microsoft or known management software (SolarWinds, Tanium, Ivanti, IBM BigFix) are explicitly excluded.
This rule detects the creation of new Windows services that are characteristic of lateral movement tools like PsExec. It looks for services with names typical of PsExec/PAExec, the use of administrative shares (ADMIN$) in image paths, or services with randomly generated names executing from temporary directories (e.g., Windows\Temp, Users\Public). Legitimate administrative tools such as svchost.exe or those within Program Files are excluded.
Detects the creation or start of the PSEXESVC service, which is a characteristic behavior of the PsExec tool used for remote execution and lateral movement.
Detects the invocation of SQL Server Management Studio (ssms.exe) by the PsExec or PsExec service process. This behavior is indicative of administrative tools being used for potentially unauthorized remote execution or lateral movement.
Detects the execution of PsExec.exe in correlation with the installation of the PSEXESVC service on the same host within a 15-minute timeframe. The rule includes an allowlist filter for authorized administrative accounts to minimize alerts for legitimate infrastructure management.
Detects the execution of the PsExec service (psexesvc.exe) which is commonly used for remote command execution and lateral movement. This rule monitors for process creation events where psexesvc.exe is spawned by services.exe or wininit.exe, indicative of a remote service installation typically associated with administrative or adversary activity.
Detects the execution of psexesvc.exe, the service component of the PsExec tool, spawned from services.exe. This activity is indicative of lateral movement through the use of PsExec, which installs and executes the service to run commands remotely.
Detects the execution of reconnaissance commands (ipconfig.exe or tasklist.exe) launched directly by the PsExec service (psexesvc.exe). This pattern is often indicative of post-exploitation discovery activities following lateral movement using PsExec.
Detects the execution of PsExec (psexec.exe or psexesvc.exe) where the binary is not digitally signed by Microsoft Corporation. This is often an indicator of renamed or tampered versions of the tool used for lateral movement or remote command execution.
This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.
This rule detects the execution of common remote administration tools (PsExec, PaExec, RemCom) specifically on devices identified as domain controllers based on their naming convention.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects the presence of the 'PSEXESVC' named pipe activity over SMB, which is a hallmark indicator of the PsExec tool being used to facilitate remote execution and lateral movement.
This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.
This rule detects SMB traffic indicative of remote service creation over the SVCCTL named pipe, a pattern characteristic of tools like PsExec used for lateral movement and remote code execution.
This rule detects potential lateral movement activities by monitoring for the execution of 'psexec', 'wmiexec', or 'schtasks' commands within a short timeframe on the same computer. A count of 2 or more such command executions within an hour is flagged as suspicious, indicating potential adversary activity.
Page 1 of 8