title: Suspicious PsExec Execution - Zeek
id: f1b3a22a-45e6-4004-afb5-4291f9c21166
status: test
description: detects execution of psexec or paexec with renamed service name, this rule helps to filter out the noise if psexec is used for legit purposes or if attacker uses a different psexec client other than sysinternal one
author: 'Samir Bousseaden, @neu5ron'
references:
  - https://github.com/neo23x0/sigma/blob/d42e87edd741dd646db946f30964f331f92f50e6/rules/windows/builtin/win_susp_psexec.yml
date: 2020/04/02
modified: 2021/11/27
logsource:
  product: zeek
  service: smb_files
detection:
  selection1:
    path|contains|all:
      - '\\'
      - '\IPC$'
    name|endswith:
      - '-stdin'
      - '-stdout'
      - '-stderr'
  selection2:
    name|contains|all:
      - '\\'
      - '\IPC$'
    path|startswith: 'PSEXESVC'
  condition: selection1 and not selection2
falsepositives:
  - Unknown
level: high
tags:
  - attack.lateral_movement
  - attack.t1021.002
