Renamed PAExec Execution

 1title: Renamed PAExec Execution
 2id: c4e49831-1496-40cf-8ce1-b53f942b02f9
 3related:
 4    - id: 7b0666ad-3e38-4e3d-9bab-78b06de85f7b
 5      type: obsoletes
 6status: test
 7description: Detects execution of renamed version of PAExec. Often used by attackers
 8references:
 9    - https://www.poweradmin.com/paexec/
10    - https://summit.fireeye.com/content/dam/fireeye-www/summit/cds-2018/presentations/cds18-technical-s05-att&cking-fin7.pdf
11author: Florian Roth (Nextron Systems), Jason Lynch
12date: 2021/05/22
13modified: 2023/02/14
14tags:
15    - attack.defense_evasion
16    - attack.t1202
17logsource:
18    category: process_creation
19    product: windows
20detection:
21    selection:
22        - Description: 'PAExec Application'
23        - OriginalFileName: 'PAExec.exe'
24        - Product|contains: 'PAExec'
25        - Imphash:
26              - 11D40A7B7876288F919AB819CC2D9802
27              - 6444f8a34e99b8f7d9647de66aabe516
28              - dfd6aa3f7b2b1035b76b718f1ddc689f
29              - 1a6cca4d5460b1710a12dea39e4a592c
30        - Hashes|contains:
31              - IMPHASH=11D40A7B7876288F919AB819CC2D9802
32              - IMPHASH=6444f8a34e99b8f7d9647de66aabe516
33              - IMPHASH=dfd6aa3f7b2b1035b76b718f1ddc689f
34              - IMPHASH=1a6cca4d5460b1710a12dea39e4a592c
35    filter:
36        - Image|endswith: '\paexec.exe'
37        - Image|startswith: 'C:\Windows\PAExec-'
38    condition: selection and not filter
39falsepositives:
40    - Weird admins that rename their tools
41    - Software companies that bundle PAExec with their software and rename it, so that it is less embarrassing
42    - When executed with the "-s" flag. PAExec will copy itself to the "C:\Windows\" directory with a different name. Usually like this "PAExec-[XXXXX]-[ComputerName]"
43level: high