{"id":"c4e49831-1496-40cf-8ce1-b53f942b02f9","title":"Renamed PAExec Execution","description":"Detects execution of renamed version of PAExec. Often used by attackers","author":"Florian Roth (Nextron Systems), Jason Lynch","status":"test","level":"high","date":"2021-05-22","modified":"2024-11-23","tags":["attack.stealth","attack.t1202"],"technique_ids":["T1202"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Weird admins that rename their tools","Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing","When executed with the \"-s\" flag. PAExec will copy itself to the \"C:\\Windows\\\" directory with a different name. Usually like this \"PAExec-[XXXXX]-[ComputerName]\""],"references":["https://www.poweradmin.com/paexec/","https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf"],"source_path":"rules/windows/process_creation/proc_creation_win_renamed_paexec.yml","source_sha256":"e81cf6dff123b7c4336042ec4c3f5ece3ca34a7783cddf9e8642c5eb06ebfa4a","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_renamed_paexec.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Renamed PAExec Execution\nid: c4e49831-1496-40cf-8ce1-b53f942b02f9\nrelated:\n    - id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b\n      type: obsolete\nstatus: test\ndescription: Detects execution of renamed version of PAExec. Often used by attackers\nreferences:\n    - https://www.poweradmin.com/paexec/\n    - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf\nauthor: Florian Roth (Nextron Systems), Jason Lynch\ndate: 2021-05-22\nmodified: 2024-11-23\ntags:\n    - attack.stealth\n    - attack.t1202\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection:\n        - Description: 'PAExec Application'\n        - OriginalFileName: 'PAExec.exe'\n        - Product|contains: 'PAExec'\n        - Hashes|contains:\n              - IMPHASH=11D40A7B7876288F919AB819CC2D9802\n              - IMPHASH=6444f8a34e99b8f7d9647de66aabe516\n              - IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f\n              - IMPHASH=1a6cca4d5460b1710a12dea39e4a592c\n    filter_main_known_location:\n        - Image|endswith: '\\paexec.exe'\n        - Image|startswith: 'C:\\Windows\\PAExec-'\n    condition: selection and not 1 of filter_main_*\nfalsepositives:\n    - Weird admins that rename their tools\n    - Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing\n    - When executed with the \"-s\" flag. PAExec will copy itself to the \"C:\\Windows\\\" directory with a different name. Usually like this \"PAExec-[XXXXX]-[ComputerName]\"\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1202","id":"T1202","name":"Indirect Command Execution","page":"techniques/enterprise/T1202/"}],"data_path":"data/detection-rules/c4e49831-1496-40cf-8ce1-b53f942b02f9.json","kind":"sigma"}