title: Impacket PsExec Execution
id: 32d56ea1-417f-44ff-822b-882873f5f43b
status: test
description: Detects execution of Impacket's psexec.py.
author: Bhabesh Raj
references:
  - https://blog.menasec.net/2019/02/threat-hunting-3-detecting-psexec.html
date: 2020/12/14
modified: 2022/01/07
logsource:
  product: windows
  service: security
  definition: 'The advanced audit policy setting "Object Access > Audit Detailed File Share" must be configured for Success/Failure'
detection:
  selection1:
    EventID: 5145
    ShareName: \\\*\IPC$
    RelativeTargetName|contains:
      - 'RemCom_stdint'
      - 'RemCom_stdoutt'
      - 'RemCom_stderrt'
  condition: selection1
falsepositives:
  - Unknown
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
