Sigma rule: smbexec.py Service Installation

Rule

Title

smbexec.py Service Installation

Status

test

Level

high

Author

Omer Faruk Celik

Date

2018-03-20

Modified

2023-11-09

File

rules/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of smbexec.py tool by detecting a specific service installation

Log source

product

windows

service

system

Detection

selection_eid:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
selection_service_name:
    ServiceName: 'BTOBTO'
selection_service_image:
    ImagePath|contains:
        - '.bat & del '
        - '__output 2^>^&1 >'
condition: selection_eid and 1 of selection_service_*

False positives (as the rule lists them)

• Unknown

Tags

• attack.lateral-movement
• attack.execution
• attack.t1021.002
• attack.t1569.002

MITRE ATT&CK ids this rule names

• T1021.002
• T1569.002

References

• https://blog.ropnop.com/using-credentials-to-own-windows-boxes-part-2-psexec-and-services/
• https://github.com/fortra/impacket/blob/33058eb2fde6976ea62e04bc7d6b629d64d44712/examples/smbexec.py#L286-L296
• https://github.com/fortra/impacket/blob/edef71f17bc1240f9f8c957bbda98662951ac3ec/examples/smbexec.py#L60

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/builtin/system/service_control_manager/win_system_hack_smbexec.yml