{"id":"6fb63b40-e02a-403e-9ffd-3bcc1d749442","title":"Metasploit Or Impacket Service Installation Via SMB PsExec","description":"Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation","author":"Bartlomiej Czyz, Relativity","status":"test","level":"high","date":"2021-01-21","modified":"2022-10-05","tags":["attack.lateral-movement","attack.t1021.002","attack.t1570","attack.execution","attack.t1569.002"],"technique_ids":["T1021.002","T1569.002","T1570"],"logsource":{"product":"windows","service":"security","definition":"The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697"},"falsepositives":["Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name"],"references":["https://bczyz1.github.io/2021/01/30/psexec.html"],"source_path":"rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml","source_sha256":"5a0e7f3c9b3b887769f3f4d497a15e2af61ec7cbc8c1c2f613ed5175d2b827ca","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_metasploit_or_impacket_smb_psexec_service_install.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Metasploit Or Impacket Service Installation Via SMB PsExec\nid: 6fb63b40-e02a-403e-9ffd-3bcc1d749442\nrelated:\n    - id: 1a17ce75-ff0d-4f02-9709-2b7bb5618cf0\n      type: derived\nstatus: test\ndescription: Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by triggering on specific service installation\nreferences:\n    - https://bczyz1.github.io/2021/01/30/psexec.html\nauthor: Bartlomiej Czyz, Relativity\ndate: 2021-01-21\nmodified: 2022-10-05\ntags:\n    - attack.lateral-movement\n    - attack.t1021.002\n    - attack.t1570\n    - attack.execution\n    - attack.t1569.002\nlogsource:\n    product: windows\n    service: security\n    definition: The 'System Security Extension' audit subcategory need to be enabled to log the EID 4697\ndetection:\n    selection:\n        EventID: 4697\n        ServiceFileName|re: '^%systemroot%\\\\[a-zA-Z]{8}\\.exe$'\n        ServiceName|re: '(^[a-zA-Z]{4}$)|(^[a-zA-Z]{8}$)|(^[a-zA-Z]{16}$)'\n        ServiceStartType: 3  # on-demand start, see https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4697\n        ServiceType: '0x10'\n    filter:\n        ServiceName: 'PSEXESVC'\n    condition: selection and not filter\nfalsepositives:\n    - Possible, different agents with a 8 character binary and a 4, 8 or 16 character service name\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.002","id":"T1021.002","name":"SMB/Windows Admin Shares","page":"techniques/enterprise/T1021.002/"},{"key":"enterprise/T1569.002","id":"T1569.002","name":"Service Execution","page":"techniques/enterprise/T1569.002/"},{"key":"enterprise/T1570","id":"T1570","name":"Lateral Tool Transfer","page":"techniques/enterprise/T1570/"}],"data_path":"data/detection-rules/6fb63b40-e02a-403e-9ffd-3bcc1d749442.json","kind":"sigma"}