Need help with Detecting PsExec Activity

bond77s · ‎12-04-2018

I would like to create a indicator on PsExec’s use of the C$, ADMIN$, and/or IPC$ shares and identifying User Access Control (UAC) events 552 and 4648 are indicative of an attacker attempting to use the runas command or authenticate against a remote host as an alternative user, #privilegeEscalation.

skoelpin · ‎12-04-2018

What have you tried so far?

Need help with Detecting PsExec Activity

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas

Join the Conversation

Need help with Detecting PsExec Activity

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Your Feedback. Our Roadmap. Visit the PX Feedback Booth at .conf26

Agentic SOC Triage: Investigating Splunk ES Notables with MCP Server and a Local LLM

Painting a Clearer Picture: Creating Cross-Domain Visibility with AI Canvas