LoFP LoFP / system administrators may use tools like psexec for troubleshooting or administrations tasks. however, this will typically come only from certain users and certain systems that can be added to an allow list.

Techniques

Sample rules

Executable File Written in Administrative SMB Share

Description

The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). It leverages Windows Security Event Logs with EventCode 5145 to identify this activity. This behavior is significant as it is commonly used by tools like PsExec/PaExec for staging binaries before creating and starting services on remote endpoints, a technique often employed for lateral movement and remote code execution. If confirmed malicious, this activity could allow an attacker to execute arbitrary code remotely, potentially compromising additional systems within the network.

Detection logic

`wineventlog_security`
EventCode=5145
RelativeTargetName IN (
    "*.cpl",
    "*.dll",
    "*.exe",
    "*.sys"
)
ObjectType=File
ShareName IN (
    "\\\\*\\Admin$",
    "\\\\*\\C$",
    "\\\\*\\IPC$"
)


| eval AccessMask_ = tonumber(AccessMask, 16)

| where (bit_and(AccessMask_, 2) != 0) OR (bit_and(AccessMask_, 4) != 0)


| stats min(_time) as firstTime
        max(_time) as lastTime count

  by EventCode ShareName RelativeTargetName ObjectType
     AccessMask src_user src_port IpAddress dest


| `security_content_ctime(firstTime)`

| `security_content_ctime(lastTime)`

| `executable_file_written_in_administrative_smb_share_filter`