Renamed PAExec Execution
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Detects execution of renamed version of PAExec. Often used by attackers
Severity
Trouble
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (MESSAGE = "PAExec Application" OR ORIGINALFILENAME = "PAExec.exe" OR PRODUCT_NAME contains "PAExec" OR HASHES contains "IMPHASH=11D40A7B7876288F919AB819CC2D9802,IMPHASH=6444f8a34e99b8f7d9647de66aabe516,IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f,IMPHASH=1a6cca4d5460b1710a12dea39e4a592c") AND PROCESSNAME notendswith "\paexec.exe,:\Windows\PAExec-*" select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
Florian Roth (Nextron Systems), Jason Lynch
