Detection of PsExec Service Execution Artefacts

PsExec is a popular administrative tool within the Sysinternals Suite, often leveraged by attackers for lateral movement, remote command execution, and privilege escalation. When PsExec is executed against a remote target, it installs a service on the target machine and creates a unique temporary file on the filesystem to facilitate the session. This file typically follows the naming convention 'PSEXEC-*.key' and is located in the 'C:\Windows' directory. Detecting the creation of these specific files provides high-fidelity visibility into PsExec usage within an environment, enabling defenders to identify unauthorized remote administration or attacker movement between compromised hosts.

Impact

The unauthorized use of PsExec can lead to remote code execution, credential dumping, and full system compromise. If an attacker gains access to credentials with administrative privileges, they can use this tool to move laterally through an environment, escalate privileges, and establish persistence, potentially affecting multiple systems across the network simultaneously.

Recommendation

Detection engineering teams should monitor filesystem activity for the creation of PsExec service key files.

• Deploy the provided Sigma rule to monitor 'file_event' logs for the specific naming pattern 'C:\Windows\PSEXEC-*.key'.
• Configure host-based logging (such as Sysmon Event ID 11 or USN Journal monitoring) to capture file creation events.
• Use the detected file creation events to trigger an incident response investigation to verify if the execution of PsExec was authorized by system administrators.