Lateral Movement Response: PsExec / Transient Service
Detection, isolation, and permanent remediation of lateral movement performed by PsExec-style tools creating transient services via remote SCM (T1569.002 + T1021.002).
PSEXESVC.EXE on the target system and the creation of a new service on each execution (EID 7045 / EID 4697) offer detection opportunities in default logs. During response, correlate binaries created close to the PSEXESVC execution time; include SMB connection and named pipe activity in the correlation.Prepare
4 steps- Verify SMB/RPC network flow visibility
Confirm that the network security monitoring platform records SMB (445/TCP) and RPC (135/TCP + dynamic ports) traffic from workstation to workstation; east-west lateral movement depends on this visibility
- Inventory administrative shares
Document who uses SMB access to `ADMIN$` and `C$` shares in the environment; allowlist legitimate PsExec/deployment tools
- Prepare a centralized EID 7045 correlation rule
Define the short-lived service signature in SIEM: EID 7045 (service installation) → EID 7036 "stopped" or registry key deletion within 60 seconds
- Prepare a list of affected machines
Pull activity history for accounts with indicators of credential theft or lateral movement from SIEM; identify the movement starting point
Detect & Analyze
6 steps- EID 7045 short-lifespan correlation on target machine
In SIEM, look for a sequence of EID 7045 followed very shortly by service deletion or EID 7036 "stopped"; if `ServiceFileName` points to a temporary name or temp directory, this is a PsExec-style usage signature