PsExec Service Installation

Title: PsExec Service Installation
Status: test
Description:Detects PsExec service installation and execution events
References:
  -https://www.jpcert.or.jp/english/pub/sr/ir_research.html
  -https://jpcertcc.github.io/ToolAnalysisResultSheet
Author: Thomas Patzke
Date: 2017-06-12
modified:2023-08-04
Tags:

• -'attack.execution'
• -'attack.t1569.002'
• -'attack.s0029'

Logsource:

• product: windows
• service: system

Detection:
  selection_eid:
    Provider_Name: 'Service Control Manager'
    EventID: '7045'
  selection_service:
ServiceName:'PSEXESVC' ImagePath|endswith:'\PSEXESVC.exe'   condition:all of selection_*
Falsepositives:
  -Unknown
Level: medium