Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
71
42
12
10
8
Contributors
43
35
20
13
7
Categories
85
60
25
14
12
Platforms
151
4
Products / Services
36
36
27
21
12
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
CVEs
1
IDS Classtypes
8
2
IDS Protocols
12
This rule detects the creation of the PSEXESVC.exe process, which is the service component of PsExec. The presence and execution of this service indicate that PsExec was used to remotely execute commands or applications on the system.
This rule detects the execution of a child process by the PSEXESVC.exe service, specifically when that child process runs with LOCAL_SYSTEM privileges. This indicates that a command was remotely initiated on the system with the highest possible privileges, rather than the privileges of the initiating user account. This behavior is characteristic of PsExec being used for remote execution with SYSTEM-level access.
Detects the execution of Sysinternals tools that have been installed via an AppX package. This method of deployment might be used by attackers to bypass detection mechanisms that rely on monitoring standard system paths for these tools.
This rule detects the execution of PsExec or PAExec when the service name has been renamed from its default 'PSEXESVC'. It specifically looks for SMB file access events (smb_files) in Zeek logs where the path contains '\IPC$' and the name ends with '-stdin', '-stdout', or '-stderr', but filters out events where the name starts with 'PSEXESVC'. This helps to identify potentially malicious use of PsExec-like tools that attempt to evade detection by altering the service name, while reducing noise from legitimate PsExec usage or other PsExec clients.
Detects the installation of a service by PAExec, a remote administration tool. This rule specifically looks for Event ID 7045 from the Service Control Manager, indicating a service installation, and then filters for service names or image paths starting with 'PAExec-'. This is a common indicator of PAExec being used to execute commands or deploy tools remotely.
Detects when Microsoft Defender for Endpoint blocks process creations originating from PSExec or WMI commands. This rule specifically looks for Event ID 1121 (Attack Surface Reduction rule blocked action) where the process name ends with 'wmiprvse.exe' (WMI Provider Host) or 'psexesvc.exe' (PsExec service). This indicates that an ASR rule designed to prevent execution via these methods has been triggered and successfully blocked the action.
Detects the creation of the PSEXEC key file, which is generated whenever a PsExec command is executed. This file is written to the file system and recorded in the USN Journal on the target system, serving as an indicator of PsExec activity.
Detects the creation of the default named pipe for PsExec (PSEXESVC) when the PsExec executable is run from suspicious locations such as temporary directories, public user folders, or common download/desktop locations. This activity can indicate the use of PsExec by an attacker.
Detects the creation of the default CSExec service executable file, 'csexecsvc.exe', which indicates the installation and potential execution of the CSExec service. CSExec is a tool similar to PsExec, used for remote command execution.
Detects the creation of the default PsExec service executable file, 'PSEXESVC.exe', which is indicative of PsExec being used to install and execute a service on a system.
Detects the execution of PsExec's service component (psexesvc.exe) when it has been renamed. This often indicates an attempt to evade detection by security tools that monitor for the default service name, as legitimate administrators typically use the original name.
Detects the execution of 'csexec.exe', a remote execution tool similar to PsExec. This tool can be used by attackers for lateral movement or remote code execution within a network.
This rule detects suspicious command-line flag combinations often used by tools like PsExec to execute commands with elevated privileges, specifically targeting 'system' or 'administrator' accounts. It looks for the presence of user-setting flags ('-u system', '--user system', '-u NT', etc.) combined with command execution flags ('-c cmd', '-c powershell', '-c whoami', etc.). This pattern is indicative of an attempt to escalate privileges or execute commands as a highly privileged user.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
Detects the creation of a named pipe with a name starting with '\PAExec', which is the default named pipe used by the PAExec utility. This can indicate remote execution activity using PAExec.
Detects the execution of a Sysinternals Tool via the creation of the "EulaAccepted" registry key. Many Sysinternals tools create this key upon first execution to signify acceptance of the End User License Agreement (EULA). This can be an indicator of Sysinternals tools being used on a system, which are often leveraged by adversaries for various post-exploitation activities.
Detects the creation of the "accepteula" registry key by Sysinternals tools that have been renamed. This behavior is suspicious because legitimate Sysinternals tools typically create this key with their original executable names. Adversaries often rename tools to evade detection, and this rule specifically looks for instances where the EULA acceptance key is created by an executable whose name does not match the expected Sysinternals tool name.
Detects default CSExec service filename which indicates CSExec service installation and execution
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
Detects installation or execution of services
Detects PsExec service installation and execution events
Page 7 of 8