Title:
PsExec/PAExec Escalation to LOCAL SYSTEM
Status:
test
Description:Detects suspicious commandline flags used by PsExec and PAExec to escalate a command line to LOCAL_SYSTEM rights
References:
-https://learn.microsoft.com/en-us/sysinternals/downloads/psexec
-https://www.poweradmin.com/paexec/
-https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
Date: 2021-11-23
modified:2024-03-05
Tags:
- -'attack.resource-development'
- -'attack.t1587.001'
Logsource:
- category: process_creation
- product: windows
Detection:
selection_sys:
CommandLine|contains|windash:
-' -s cmd'
-' -s -i cmd'
-' -i -s cmd'
-' -s pwsh'
-' -s -i pwsh'
-' -i -s pwsh'
-' -s powershell'
-' -s -i powershell'
-' -i -s powershell'
selection_other:
CommandLine|contains:
-'psexec'
-'paexec'
-'accepteula'
condition:
all of selection_*
Falsepositives:
-Admins that use PsExec or PAExec to escalate to the SYSTEM account for maintenance purposes (rare)
-Users that debug Microsoft Intune issues using the commands mentioned in the official documentation; see https://learn.microsoft.com/en-us/mem/intune/apps/intune-management-extension
Level:
high
