---
tags:
  - Event Logs
  - Prefetch
  - Windows

hide:
  - navigation
  - tags
---

# Have there been any executions of PsExeSrv?

**ID**: Q1037

**Description**: PsExec is a command-line tool that allows you to execute commands on remote computers. It is part of the Sysinternals suite of tools, which are a collection of free and open-source utilities for Windows system administration.  It works by establishing a remote connection to the target computer and then executing the specified command. In order to do this, it copies an executable to the target system and installs a service to run that executable.

**Approaches to Answer**

-  [Examine Windows Prefetch for evidence of PsExeSvc [Q1037.10]](#examine-windows-prefetch-for-evidence-of-psexesvc)
    - Parse Windows Prefetch files and look for PsExeSvc.
    - Tags: <span class="dfiqTag">Windows</span> <span class="dfiqTag">Prefetch</span>
-  [Examine Windows Event Logs for PsExeSvc executions [Q1037.11]](#examine-windows-event-logs-for-psexesvc-executions)
    - Parse the Windows Security Event Log and look for PsExeSvc processes being created.
    - Tags: <span class="dfiqTag">Windows</span> <span class="dfiqTag">Event Logs</span>
-  [Examine Windows Event Logs for PsExeSvc Service Installations [Q1037.12]](#examine-windows-event-logs-for-psexesvc-service-installations)
    - Parse the Windows Security Event Log and look for the PsExeSvc service being installed.
    - Tags: <span class="dfiqTag">Windows</span> <span class="dfiqTag">Event Logs</span>

# Approaches

!!! Note
    There are often multiple ways to approach answering a question.
    This section explains the approaches considered, how they work, and any
    benefits or drawbacks to each. All these approaches have different pros
    and cons. They can be used individually or in conjunction.

## Examine Windows Prefetch for evidence of PsExeSvc
### 🗂️ Explanation
Windows Prefetch files are designed to speed up application start times. To do this, they store information about recently launched applications, including the file name of the executable and the number of times it has been run. 

#### References
 - [Prefetch on the ForensicsWiki](https://forensics.wiki/prefetch/)
 - [PsExec on MITRE ATT&CK](https://attack.mitre.org/software/S0029/)
 - [Detecting PsExec Usage by 13Cubed](https://www.youtube.com/watch?v=oVM1nQhDZQc)

### 📝 Notes

Each approach comes with certain caveats or limitations. These can often
be tacit knowledge or assumed that "everyone knows that" (even though they
don't). This can lead to incorrect assumptions and analysis.
Explicitly stating what is covered and not covered by the approach reduces
ambiguity.

!!! success "Covered"

     - Executions of PsExeSvc on Windows systems with Prefetch enabled.

!!! failure "Not Covered"

     - Systems where the Prefetch service has been disabled.
     - There is a maximum number of `.pf` allowed by Windows (the number varies by Windows version). If too many other Prefetch files were created, the PsExec Prefetch file may have been deleted, and thus will not be parsed.
     - Instances when the PsExeSvc executable has been renamed.
     - Non-Windows systems, as the Prefetch service is Windows-only.


### 💾 Data

The following data source(s) are needed for this approach to the question.

**Description**
:  Files used by the Windows Prefetch service.


**Type**
:  [ForensicArtifact](https://github.com/ForensicArtifacts/artifacts#digital-forensics-artifacts-repository)

**Value**
:  WindowsPrefetchFiles ([view on GitHub](https://github.com/ForensicArtifacts/artifacts/search?q=WindowsPrefetchFiles))

### ⚙️ Processors

A processor is what takes the [data](#💾-data) collected and processes it in
some way to produce structured data for an investigator to review. Multiple
processor options can be defined, as there are often multiple programs capable
of doing similar processing. Plaso is an example of a processor (it processes
raw artifacts into a timeline). After the data is processed, additional analysis
steps may be needed to answer the question.

The following processors can process the raw data specified above. Explicit
instructions on how to run the processor are *not* included here, but any
relevant configuration options are.


=== "Plaso"
    More information on [Plaso](https://forensics.wiki/plaso).

    Recommended options:

    ```
     --parsers prefetch
    ```

    #### 📊 Analysis

    After processing the raw data, further analysis steps are necessary to answer
    the question. After loading Plaso's output into one of these
    analysis platforms, use the following steps to refine the data to answer the
    question.


    OpenSearch

    1. Filter the results to just Prefetch files for psexesvc.exe
       - OpenSearch query:

         ```
         data_type:"windows:prefetch:execution" AND executable:psexesvc\.exe
         ```
## Examine Windows Event Logs for PsExeSvc executions
### 🗂️ Explanation
Windows systems can be set to log new process creation events to the Security event log. The logs contain the new process name, process ID, parent process name, process creation time, and many more useful fields.

#### References
 - [4688(S): A new process has been created](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688)
 - [PsExec on MITRE ATT&CK](https://attack.mitre.org/software/S0029/)
 - [Detecting PsExec Usage by 13Cubed](https://www.youtube.com/watch?v=oVM1nQhDZQc)

### 📝 Notes

Each approach comes with certain caveats or limitations. These can often
be tacit knowledge or assumed that "everyone knows that" (even though they
don't). This can lead to incorrect assumptions and analysis.
Explicitly stating what is covered and not covered by the approach reduces
ambiguity.

!!! success "Covered"

     - Executions of PsExeSvc on Windows systems with logging enabled.

!!! failure "Not Covered"

     - Many factors can impact log retention; if the event log containing the relevant event has been deleted, it won't be found by this approach.
     - Instances when the PsExeSvc executable has been renamed.


### 💾 Data

The following data source(s) are needed for this approach to the question.

**Description**
:  Windows Event Log files


**Type**
:  [ForensicArtifact](https://github.com/ForensicArtifacts/artifacts#digital-forensics-artifacts-repository)

**Value**
:  WindowsEventLogs ([view on GitHub](https://github.com/ForensicArtifacts/artifacts/search?q=WindowsEventLogs))

### ⚙️ Processors

A processor is what takes the [data](#💾-data) collected and processes it in
some way to produce structured data for an investigator to review. Multiple
processor options can be defined, as there are often multiple programs capable
of doing similar processing. Plaso is an example of a processor (it processes
raw artifacts into a timeline). After the data is processed, additional analysis
steps may be needed to answer the question.

The following processors can process the raw data specified above. Explicit
instructions on how to run the processor are *not* included here, but any
relevant configuration options are.


=== "Plaso"
    More information on [Plaso](https://forensics.wiki/plaso).

    Recommended options:

    ```
     --parsers winevtx
    ```

    #### 📊 Analysis

    After processing the raw data, further analysis steps are necessary to answer
    the question. After loading Plaso's output into one of these
    analysis platforms, use the following steps to refine the data to answer the
    question.


    OpenSearch

    1. Filter the results to Process Creation events containing "psexesvc.exe"
       - OpenSearch query:

         ```
         data_type:"windows:evtx:record" event_identifier:4688 source_name:Microsoft-Windows-Security-Auditing xml_string:"psexesvc.exe"
         ```
## Examine Windows Event Logs for PsExeSvc Service Installations
### 🗂️ Explanation
Windows systems can be set to log new service installations to the System event log. The logs contain the new service name, service file name, and more. When used to access a remote system, PsExec installs a service (by default named `PSEXESVC`) on the target system.

#### References
 - [4688(S): A new process has been created](https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4688)
 - [PsExec on MITRE ATT&CK](https://attack.mitre.org/software/S0029/)
 - [Detecting PsExec Usage by 13Cubed](https://www.youtube.com/watch?v=oVM1nQhDZQc)

### 📝 Notes

Each approach comes with certain caveats or limitations. These can often
be tacit knowledge or assumed that "everyone knows that" (even though they
don't). This can lead to incorrect assumptions and analysis.
Explicitly stating what is covered and not covered by the approach reduces
ambiguity.

!!! success "Covered"

     - Installations of the PsExeSvc Service on Windows systems with logging enabled.

!!! failure "Not Covered"

     - Many factors can impact log retention; if the event log containing the relevant event has been deleted, it won't be found by this approach.
     - Instances when the PsExeSvc service has been renamed.


### 💾 Data

The following data source(s) are needed for this approach to the question.

**Description**
:  Windows Event Log files


**Type**
:  [ForensicArtifact](https://github.com/ForensicArtifacts/artifacts#digital-forensics-artifacts-repository)

**Value**
:  WindowsEventLogs ([view on GitHub](https://github.com/ForensicArtifacts/artifacts/search?q=WindowsEventLogs))

### ⚙️ Processors

A processor is what takes the [data](#💾-data) collected and processes it in
some way to produce structured data for an investigator to review. Multiple
processor options can be defined, as there are often multiple programs capable
of doing similar processing. Plaso is an example of a processor (it processes
raw artifacts into a timeline). After the data is processed, additional analysis
steps may be needed to answer the question.

The following processors can process the raw data specified above. Explicit
instructions on how to run the processor are *not* included here, but any
relevant configuration options are.


=== "Plaso"
    More information on [Plaso](https://forensics.wiki/plaso).

    Recommended options:

    ```
     --parsers winevtx
    ```

    #### 📊 Analysis

    After processing the raw data, further analysis steps are necessary to answer
    the question. After loading Plaso's output into one of these
    analysis platforms, use the following steps to refine the data to answer the
    question.


    OpenSearch

    1. Filter the results to Service Install events for `PSEXESVC`
       - OpenSearch query:

         ```
         data_type:"windows:evtx:record" event_identifier:7045 source_name:"Service Control Manager" xml_string:"Name=\"ServiceName\">PSEXESVC"
         ```
