Detecting PsExec usage with Wazuh

| by | Wazuh 4.3
Post icon


PsExec is a part of Sysinternals command line tools named PsTools. It facilitates system administration and can execute processes on local and remote systems. While PsExec is not malicious, several threat actors such as Turla, Fin6, and Cleaver use it for activities such as lateral movement and privilege escalation within a network; it is therefore important to detect its usage.

In this blog post, we examine PsExec usage on a Windows endpoint and we detect its activities using the Wazuh platform.

Setting up the lab

This section explains how the Windows endpoint and Wazuh manager are configured. Due to the nature of the activities being done, we recommend using disposable virtual machines for the Windows endpoint.

Wazuh server

The Wazuh server analyzes the data received from Wazuh agents and triggers alerts when threats or anomalies are detected. You can find the installation guide here.

Windows endpoint

We can install the Wazuh agent and configure Sysmon on a Windows endpoint by following the steps below:

  • Install and enroll the Wazuh agent on the Windows endpoint. The agent will send the logs generated on the endpoint to the Wazuh server.
  • Download Sysmon from the Microsoft Sysinternals page.
  • Download the Sysmon configuration file sysmonconfig.xml.
  • Install Sysmon with the downloaded configuration file using PowerShell (as administrator):
.\sysmon.exe -accepteula -i .\sysmonconfig.xml
  • Configure the agent to capture Sysmon events by adding the following settings to the agent configuration file in “C:\Program Files (x86)\ossec-agent\ossec.conf“:
  • To apply the changes, restart the agent by running the following PowerShell command as an administrator:
Restart-Service -Name wazuh

Detection with Wazuh

Out of the Box, Wazuh can detect when a new service is created on a Windows machine. To extend the detection capabilities to cover PsExec activities, we add the following rules to the /var/ossec/etc/rules/local_rules.xml file on the Wazuh manager.

<group name="windows,sysmon">

  <rule id="160010" level="10">
    <field name="win.eventdata.eventType" type="pcre2" >SetValue</field>
    <field name="win.eventdata.targetObject" type="pcre2" >\\\\SOFTWARE\\\\Sysinternals\\\\PsExec\\\\EulaAccepted</field>
    <description>PsExec EULA registry found on $(</description>
  <rule id="160011" level="10">
    <field name="win.eventdata.targetObject" type="pcre2" >HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PSEXESVC</field>
    <field name="win.eventdata.eventType" type="pcre2" >^SetValue$</field>
    <field name="win.eventdata.user" type="pcre2" >NT AUTHORITY\\\\SYSTEM</field>
    <description>PsExec service running as $(win.eventdata.user) has been created on $(</description>
  <rule id="160012" level="10">
    <field name="win.eventdata.targetObject" type="pcre2" >HKLM\\\\System\\\\CurrentControlSet\\\\Services\\\\PSEXESVC</field>
    <field name="win.eventdata.eventType" type="pcre2" >^DeleteKey$</field>
    <field name="win.eventdata.user" type="pcre2" >NT AUTHORITY\\\\SYSTEM</field>
    <description>PsExec service running as $(win.eventdata.user) has been deleted on $(</description>
  <rule id="160013" level="10">
    <field name="win.eventdata.eventType" type="pcre2" >CreatePipe</field>
    <field name="win.eventdata.image" type="pcre2" >\\\\PSEXESVC.exe</field>
    <match type="pcre2">(?i)(PSEXESVC|stdin|stdout|stderr)</match>
    <field name="win.eventdata.user" type="pcre2" >NT AUTHORITY\\\\SYSTEM</field>
    <description>PsExec named pipe running as $(win.eventdata.user) has been found on $(</description>


We restart the Wazuh server so it starts using the new rules:

systemctl restart wazuh-manager

Privilege escalation with PsExec

Privilege escalation techniques allow an adversary to gain a higher privilege level on a system or network. Examples of elevated privileges include escalating a standard account to an administrator, or from a local administrator account to a local SYSTEM user. The SYSTEM account is the highest privilege level in the Windows user model, it is used by the operating system and services that run under Windows.

In this section, we use PsExec to escalate the Windows PowerShell privileges from administrator to SYSTEM, we also analyze the log generated by its execution.

PsExec execution

We download the PsTools archive from the Microsoft Sysinternals page and extract the PsExec binary from the archive. The following command escalates a Windows PowerShell process from an administrator user to a SYSTEM user:

./psexec -i -s powershell

We can confirm the new instance of PowerShell is now running as SYSTEM using the command below:


The result shows PowerShell is now running as a SYSTEM user:

PS C:\Windows\system32> whoami
nt authority\system

Detected activity

This section describes the activity discovered on the Windows endpoint as a result of running PsExec.

License agreement key

The first time PsExec is executed on a system, it displays an End User License Agreement (EULA) prompt which the user needs to accept. This creates a registry key: HKCU\Software\Sysinternals\PsExec\EulaAccepted=0x01, which we can see in the logs of the Windows endpoint below.

Registry value set:
RuleName: technique_id=T1569.002,technique_name=Service Execution
EventType: SetValue
UtcTime: 2022-05-20 10:13:18.933
ProcessGuid: {5a1492c8-69bc-6287-9d01-000000000b00}
ProcessId: 5176
Image: C:\PSTools\PsExec.exe
TargetObject: HKU\S-1-5-21-239732096-1583447084-1784059003-1001\SOFTWARE\Sysinternals\PsExec\EulaAccepted
Details: DWORD (0x00000001)
User: WAZUH-LAB\Wazuh-Test

Service creation and deletion

A service named PSEXESVC is created each time PsExec is executed on a machine. It is also deleted once PsExec is exited. These events are logged on the Windows endpoint as seen below.

Registry value set:
RuleName: technique_id=T1543,technique_name=Service Creation
EventType: SetValue
UtcTime: 2022-05-20 10:13:19.028
ProcessGuid: {5a1492c8-602f-6287-0b00-000000000b00}
ProcessId: 656
Image: C:\Windows\system32\services.exe
TargetObject: HKLM\System\CurrentControlSet\Services\PSEXESVC\Type
Details: DWORD (0x00000010)
Registry object added or deleted:
RuleName: technique_id=T1543,technique_name=Service Creation
EventType: DeleteKey
UtcTime: 2022-05-18 12:09:07.593
ProcessGuid: {5a1492c8-df91-6284-0b00-000000000a00}
ProcessId: 648
Image: C:\Windows\system32\services.exe
TargetObject: HKLM\System\CurrentControlSet\Services\PSEXESVC

Use of named pipes

Named pipes provide communication between processes on the same computer or between processes on different computers within a network. Four named pipes are created when PsExec is running. One is created for the PSEXESVC service, while the other named pipes redirect the stdin, stdout, and stderr processes. Using the pipelist program, we can see the following pipes running on the Windows endpoint:


The logged activities for PSEXESVC named pipe are seen below:

Pipe Created:
RuleName: -
EventType: CreatePipe
UtcTime: 2022-05-20 10:13:19.215
ProcessGuid: {5a1492c8-69bf-6287-9e01-000000000b00}
ProcessId: 3992
Image: C:\Windows\PSEXESVC.exe


Several alerts were triggered on the Wazuh dashboard after PsExec had been executed on the Windows endpoint. The screenshot below shows that Wazuh has detected the usage of PsExec.


In this blog post, we have been able to detect the usage of PsExec on the Windows endpoint. PsExec service creation was detected out of the box by Wazuh, while other activities were detected on the Wazuh platform using custom Wazuh detection rules.