Sigma rule: Metasploit Or Impacket Service Installation Via SMB PsExec

Rule

Title

Metasploit Or Impacket Service Installation Via SMB PsExec

Status

unsupported

Level

high

Author

Bartlomiej Czyz, Relativity

Date

2021/01/21

Modified

2022/03/21

File

unsupported/windows/win_metasploit_or_impacket_smb_psexec_service_install.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation

Log source

product

windows

service

system

Detection

selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
selection_1:
    ImagePath|re: '^%systemroot%\\[a-zA-Z]{8}\.exe$'
    ServiceName|re: '(^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$)'
    StartType: '3'  # on-demand start, see https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4697
    ServiceType: '0x10'
filter:
    ServiceName: 'PSEXESVC'
condition: selection and selection_1 and not filter

False positives (as the rule lists them)

• Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name

Tags

• attack.lateral_movement
• attack.t1021.002
• attack.t1570
• attack.execution
• attack.t1569.002

MITRE ATT&CK ids this rule names

• T1021.002
• T1569.002
• T1570

References

• https://bczyz1.github.io/2021/01/30/psexec.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/unsupported/windows/win_metasploit_or_impacket_smb_psexec_service_install.yml