
title: PsExec/PAExec Flags
author: Florian Roth
date: 2021/05/22
description: Detects suspicious flags used by PsExec and PAExec but no usual program
  name in command line
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_10:
    CommandLine:
    - '*paexec*'
    - '*PsExec*'
  SELECTION_2:
    EventID: 1
  SELECTION_3:
    CommandLine: '*\\127.0.0.1*'
  SELECTION_4:
    CommandLine: '* -s *'
  SELECTION_5:
    CommandLine: '*cmd.exe*'
  SELECTION_6:
    CommandLine: '* /accepteula *'
  SELECTION_7:
    CommandLine: '*cmd /c *'
  SELECTION_8:
    CommandLine: '* -u *'
  SELECTION_9:
    CommandLine: '* -p *'
  condition: (SELECTION_1 and (SELECTION_2 and ((SELECTION_3 and SELECTION_4 and SELECTION_5)
    or (SELECTION_6 and SELECTION_7 and SELECTION_8 and SELECTION_9))) and  not (SELECTION_10))
falsepositives:
- Weird admins that rename their tools
- Software companies that bundle PsExec/PAExec with their software and rename it,
  so that it is less embarrassing
id: 207b0396-3689-42d9-8399-4222658efc99
level: high
logsource:
  category: process_creation
  product: windows
references:
- https://docs.microsoft.com/en-us/sysinternals/downloads/psexec
- https://www.poweradmin.com/paexec/
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
status: experimental
tags:
- attack.develop_capabilities
- attack.t1587.001
ruletype: SIGMA
