Detection of PsExec Service Execution as SYSTEM

The Sysinternals PsExec utility is frequently leveraged by threat actors to perform remote command execution and lateral movement. When the utility is used with the -s flag, the associated service, PSEXESVC.exe, executes remote commands with LOCAL SYSTEM privileges rather than those of the authenticated user. While PsExec is a legitimate administration tool, its execution by non-authorized accounts often indicates an ongoing attack where an adversary has already obtained administrative credentials and is escalating to system-level access to disable security software, dump credentials, or establish persistence. Monitoring for child processes of PSEXESVC.exe executing under the SYSTEM user account is a high-fidelity indicator of such activity.

Attack Chain

1. Attacker performs credential dumping on an initial entry point to obtain local administrator credentials.
2. Attacker uses PsExec to authenticate to a target endpoint using stolen credentials via SMB/RPC.
3. The PSEXESVC service binary is dropped into the Admin$ share on the remote target.
4. The service is started remotely using the Service Control Manager.
5. The PSEXESVC.exe process initializes and creates a process designated by the attacker.
6. The child process runs as LOCAL SYSTEM due to the -s flag provided by the attacker.
7. Attacker executes malicious payloads, such as backdoors or ransomware components, with elevated privileges.
8. Attacker clears logs or modifies system configurations to maintain stealth.

Impact

Successful abuse of PsExec to gain SYSTEM privileges typically leads to full host compromise, including the ability to disable EDR/AV solutions, exfiltrate sensitive data, and perform domain-wide movement. This technique is observed in widespread ransomware deployments and targeted espionage campaigns where administrative lateral movement is a core objective.

Recommendation

• Deploy the provided Sigma rule to monitor for suspicious process creation events originating from PSEXESVC.exe.
• Enable Sysmon process-creation logging to capture the ParentImage and User fields.
• Audit and restrict the use of PsExec across the environment, limiting execution to authorized jump hosts or administrative management workstations.
• Tune the detection to account for legitimate IT management tooling, such as the Microsoft Intune management extension, which may trigger similar alerts.