Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
71
42
12
10
8
Contributors
43
35
20
13
7
Categories
85
60
25
14
12
Platforms
151
4
Products / Services
36
36
27
21
12
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
8
2
IDS Protocols
12
Detects the presence of the 'PSEXESVC' named pipe activity over SMB, which is a hallmark indicator of the PsExec tool being used to facilitate remote execution and lateral movement.
Detects network traffic associated with PsExec lateral movement activity, specifically looking for the creation of the PSEXESVC named pipe over SMB/ADMIN$ shares, which is commonly used by PsExec to remotely execute services and commands on target systems.
Detects network traffic associated with PsExec lateral movement activity, specifically looking for the creation of the PSEXESVC named pipe over SMB/ADMIN$ shares, which is commonly used by PsExec to remotely execute services and commands on target systems.
This rule detects the use of the PSEXESVC named pipe during a write operation over the SMB protocol, which is indicative of lateral movement using the PsExec tool.
This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.
Detects the execution of PsExec (psexec.exe or psexesvc.exe) where the binary is not digitally signed by Microsoft Corporation. This is often an indicator of renamed or tampered versions of the tool used for lateral movement or remote command execution.
This rule detects the execution of common remote administration tools (PsExec, PaExec, RemCom) specifically on devices identified as domain controllers based on their naming convention.
Detects PsExec used for remote command execution in lateral movement
This rule detects the use of PsExec or the Service Control Manager (sc.exe) to execute code remotely, which is a common technique used by attackers for lateral movement and remote code execution.
Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.
This rule detects SMB traffic indicative of remote service creation over the SVCCTL named pipe, a pattern characteristic of tools like PsExec used for lateral movement and remote code execution.
This rule detects the use of the PSEXESVC named pipe during a write operation over the SMB protocol, which is indicative of lateral movement using the PsExec tool.
Detects network activity characteristic of the PsExec tool performing lateral movement. The rule monitors for SMB traffic directed at the ADMIN$ share, specifically looking for the creation or access of the 'PSEXESVC' service binary, combined with the use of the 'svcctl' named pipe, which is used by PsExec to remotely control services.
Detects network activity characteristic of the PsExec tool performing lateral movement. The rule monitors for SMB traffic directed at the ADMIN$ share, specifically looking for the creation or access of the 'PSEXESVC' service binary, combined with the use of the 'svcctl' named pipe, which is used by PsExec to remotely control services.
Detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell, which are commonly used for lateral movement by adversaries. The rule identifies instances where these tools are executed multiple times within a short period (more than 2 times in 5 minutes) from non-system accounts and outside of standard system directories, indicating potential malicious activity.
Detects the execution of processes associated with remote command execution, specifically identifying the PsExec service (psexesvc.exe) or the invocation of command shell (cmd.exe) by the Service Control Manager (services.exe) with remote path arguments.
Detects the execution of processes associated with remote command execution, specifically identifying the PsExec service (psexesvc.exe) or the invocation of command shell (cmd.exe) by the Service Control Manager (services.exe) with remote path arguments.
Detects the creation or modification of services associated with PsExec, a legitimate tool often abused by adversaries for remote execution. The rule looks for specific service names or file paths indicative of PsExec activity, including the default 'PSEXESVC' service name, or file paths containing 'ADMIN$' or 'IPC$' shares, or a randomly named executable in the SystemRoot directory. It filters out activity from designated administrative workstations and common system accounts.
Detects the creation or modification of services associated with PsExec, a legitimate tool often abused by adversaries for remote execution. The rule looks for specific service names or file paths indicative of PsExec activity, including the default 'PSEXESVC' service name, or file paths containing 'ADMIN$' or 'IPC$' shares, or a randomly named executable in the SystemRoot directory. It filters out activity from designated administrative workstations and common system accounts.
This rule detects suspicious usage of remote execution tools like PsExec, WMIC, and PowerShell. It specifically looks for multiple executions of these tools within a 5-minute window, originating from non-system accounts and not from standard Windows system directories. This behavior can indicate lateral movement or other malicious activity within a network.
Detects the execution of PsExec (psexec.exe or psexec64.exe) with command-line arguments indicating remote execution to a network share and the use of administrative credentials (e.g., -s, -u, -p, -c). This activity is often associated with lateral movement and remote service execution by attackers, including ransomware groups like 'The Gentlemen'.
Page 2 of 8