Techniques
Sample rules
Windows PsTools Recon Usage
- source: splunk
- technicques:
- T1082
- T1046
- T1018
Description
The following analytic identifies execution of Sysinternals PsTools and Sysinternals Suit binaries that are commonly used for reconnaissance and information gathering on Windows endpoints. PsTools (PsExec, PsFile, PsGetSid, PsInfo, PsPing, etc.) or Sysinternals Suit tools, are frequently used by administrators for legitimate maintenance but are also leveraged by threat actors to collect system, account, network and service information during discovery and lateral movement. This detection focuses on process execution and PE metadata telemetry (OriginalFileName). If confirmed malicious, this activity can indicate targeted reconnaissance and foothold escalation, enabling subsequent lateral movement or credential abuse.
Detection logic
| tstats `security_content_summariesonly`
count min(_time) as firstTime
max(_time) as lastTime
from datamodel=Endpoint.Processes where
Processes.process_name IN (
"PsGetsid.exe",
"PsGetsid64.exe",
"PsInfo.exe",
"PsInfo64.exe",
"pslist.exe",
"pslist64.exe",
"PsLoggedon.exe",
"PsLoggedon64.exe",
"psloglist.exe",
"psloglist64.exe",
"PsPing.exe",
"PsPing64.exe",
"PsService.exe",
"PsService64.exe",
"Tcpvcon.exe",
"Tcpvcon64.exe",
"Tcpvcon64a.exe"
)
OR
Processes.original_file_name IN (
"PsGetSid.exe",
"Psinfo.exe",
"pslist.exe",
"psloggedon.exe",
"psloglist.exe",
"psping.exe",
"psservice.exe",
"Tcpvcon.exe"
)
by Processes.action Processes.dest Processes.original_file_name Processes.parent_process Processes.parent_process_exec
Processes.parent_process_guid Processes.parent_process_id Processes.parent_process_name Processes.parent_process_path
Processes.process Processes.process_exec Processes.process_guid Processes.process_hash Processes.process_id
Processes.process_integrity_level Processes.process_name Processes.process_path Processes.user Processes.user_id
Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `windows_pstools_recon_usage_filter`