Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
71
42
12
10
8
Contributors
43
35
20
13
7
Categories
85
60
25
14
12
Platforms
151
4
Products / Services
36
36
27
21
12
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
CVEs
1
IDS Classtypes
8
2
IDS Protocols
12
Detects the creation of or connection to named pipes commonly associated with PsExec activity, which is often used for lateral movement. This includes the default 'psexesvc' pipe and patterns used by impacket's psexec.py.
Detects potential PsExec command execution on remote systems by looking for common command-line flags used by the utility, specifically 'accepteula', user credentials (' -u ', ' -p '), and a remote path (' \\'). It filters out connections to localhost.
Detects scenarios where an attacker execute PSexec on a remote host via SMB
Detects scenarios where an attacker installs and executes PSexec.
Detects the use of PsExec for lateral movement, a technique observed in use by Warlock ransomware affiliates. This rule identifies the creation or execution of the default PsExec service ('PSEXESVC.exe') on a target host.
This rule detects the use of PsExec or PAExec with command-line flags designed to escalate privileges to the LOCAL_SYSTEM account. Specifically, it looks for the '-s' flag, optionally combined with '-i', followed by common shell executables like 'cmd', 'powershell', or 'pwsh'. This behavior is indicative of an attempt to gain SYSTEM-level access on a Windows machine.
This rule detects the execution of commands that include the ' -accepteula' flag. This flag is commonly used by Sysinternals tools to automatically accept their End User License Agreement (EULA), allowing for non-interactive execution. The presence of this flag in a command line can indicate the use of Sysinternals utilities, which are legitimate administrative tools but are also frequently leveraged by adversaries for various post-exploitation activities.
Detects unknown programs attempting to escalate privileges to LOCAL SYSTEM by using command-line arguments commonly associated with tools like PsExec and PAExec. The rule specifically looks for combinations of '-s' (run as SYSTEM) and '-i' (interact with desktop) flags followed by common shell executables like 'cmd', 'pwsh', or 'powershell'. It filters out known instances of 'paexec' and 'PsExec' to avoid overlap with more specific rules.
Detects suspicious child processes of the PsExec service executable (PSEXESVC.exe). This activity could represent an adversary using PsExec for lateral movement and executing commands on a remote host.
This detection identifies the use of common post-exploitation tools like PsExec, Impacket (specifically WMIExec), and Mimikatz. These tools are frequently used by threat actors for lateral movement and credential access after gaining initial access. The rule looks for specific process names and command-line arguments indicative of these tools.
Detects the use of known malicious PowerShell commandlets often associated with exploitation frameworks. These commandlets perform various adversarial actions such as credential dumping, reconnaissance, persistence, privilege escalation, and data exfiltration.
Detects the execution of known offensive PowerShell scripts used for exploitation or reconnaissance, including tools from PowerSploit, PowerUpSQL, and other common red-teaming frameworks. The rule identifies specific script names and 'Invoke-Sharp' variants within PowerShell module logging data.
KQL Query from file: High-Risk assets with command line credentials
KQL Query from file: psexecsvc.py detection
KQL Query
Detects PsExec service execution via default service image name
Detects PsExec service execution via default service image name
PsExec Service Start
Sigma
Detects a PsExec service start
Detects PsExec service default pipe creation
Detects the use of NirCmd tool for command execution as SYSTEM user
Microsoft has observed Bazacall using Cobalt Strike in order to move laterally to other machines on the network.
Page 4 of 8