PsExec / service execution

Temporary Windows service over SMB runs commands remotely

categoryNetwork and infrastructure attacksseverityHighdetectability (measured in our lab)Mediumlabdetected in lab

Example: Impacket

Detection opportunity what to watch for

A benign emulation of this technique’s linchpin behaviour — the command an attacker runs, and where we’ve detonated it in the lab, exactly what the SIEM saw, what caught it, and what it missed.

What the attacker runs

ATT&CK T1569.002 · Atomic Red Team

powershell -ExecutionPolicy Bypass -File C:\lab\detonate.ps1 -Technique T1569.002 -Tool atomic -RunId run-2026-10-20-013 -Command 'Invoke-AtomicTest T1569.002 -TestGuids bf07f520-3909-4ef5-aa22-877a50f2f77b -TimeoutSeconds 120'

What our lab measured

partially detected windows · 2026-10-20 · detected in 1s

What it looked like in telemetry

Log source	What it means
Sysmon · EID 1	Access token manipulation: SYSTEM-integrity process created by a non-service parent
Sysmon · EID 1	Suspicious Windows cmd shell execution
Sysmon · EID 1	Windows command prompt started by an abnormal process
Sysmon · EID 11	C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe created a new scripting file under Windows Temp or User data folder
Sysmon · EID 11	Executable file dropped in folder commonly used by malware
PowerShell · EID 4104	Powershell script querying system environment variables
PowerShell · EID 4104	Powershell script recursively collected files from a filesystem search
PowerShell · EID 4104	Powershell script searching filesystem
… and 7 more event type(s)

Detection that fired

✓ Wazuh 100230 (level 10) lab rule — Access token manipulation: SYSTEM-integrity process created by a non-service parent

Plus 21 stock Wazuh/Sysmon rule(s) in the window.

Background noise in the window: ~105499 incidental alerts/hour — tune against this.

Classification

26 values: 15 reviewed, 2 lab-measured, 8 imported, 1 derived. What do these mean?

Exploitability

Attack vector	Network attacks
Reach (CVSS)	Network
Attack complexity	Low
Privileges required	High
User interaction	None
Attacker skill required	Low
Resources required	Low
Likelihood / prevalence	High
Maturity	Commoditized

Impact & scope

Severity	High
Impact	AvailabilityConfidentialityIntegrity
Platform	Windows
Environment	On-premises
Target asset class	EndpointServer
Kill-chain phase (tactic)	Execution
Remote support	No

Detection & telemetry

Detectability (measured in our lab)	Medium
Detectability (public detection content)	High
Noise level	High
Testability	Atomic Red Team test
Data sources (ATT&CK data components)	Network Connection CreationProcess CreationService CreationWindows Registry Key Modification

Detection & response

Mitigated by 3

M1022 attack-mitigation
M1026 attack-mitigation
M1040 attack-mitigation

Detected by 46

DET0421 attack-detection-strategy
10018e73-06ec-46ec-8107-9172f1e04ff2 sigma
1a31b18a-f00c-4061-9900-f735b96c99fc sigma
1f1d8209-636e-4c6c-a137-781cca8b82f9 sigma
259e5a6a-b8d2-4c38-86e2-26c5e651361d sigma
2a072a96-a086-49fa-bcb5-15cc5a619093 sigma
2a926e6a-4b81-4011-8a96-e36cc8c04302 sigma
31c51af6-e7aa-4da7-84d4-8f32cc580af2 sigma
41504465-5e3a-4a5b-a5b4-2a0baadd4463 sigma
42c575ea-e41e-41f1-b248-8093c3e82a28 sigma
4976aa50-8f41-45c6-8b15-ab3fc10e79ed sigma
4a5f5a5e-ac01-474b-9b4e-d61298c9df1d sigma
4e2ed651-1906-4a59-a78a-18220fca1b22 sigma
52a85084-6989-40c3-8f32-091e12e13f09 sigma
5a105d34-05fc-401e-8553-272b45c1522d sigma
5bb68627-3198-40ca-b458-49f973db8752 sigma
61a7697c-cb79-42a8-a2ff-5f0cdfae0130 sigma
6fb63b40-e02a-403e-9ffd-3bcc1d749442 sigma
771d1eb5-9587-4568-95fb-9ec44153a012 sigma
7eff1a7f-dd45-4c20-877a-f21e342a7611 sigma
93199800-b52a-4dec-b762-75212c196542 sigma
97b9ce1e-c5ab-11ea-87d0-0242ac130003 sigma
9e36ed87-4986-482e-8e3b-5c23ffff11bf sigma
a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12 sigma
a2e5019d-a658-4c6a-92bf-7197b54e2cae sigma
a7cd7306-df8b-4398-b711-6f3e4935cf16 sigma
b5281f31-f9cc-4d0d-95d0-45b91c45b487 sigma
b640c0b8-87f8-4daa-aef8-95a24261dd1d sigma
bf74135c-18e8-4a72-a926-0e4f47888c19 sigma
c484e533-ee16-4a93-b6ac-f0ea4868b2f1 sigma
c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9 sigma
c8b00925-926c-47e3-beea-298fd563728e sigma
cb062102-587e-4414-8efa-dbe3c7bf19c6 sigma
d08a2711-ee8b-4323-bdec-b7d85e892b31 sigma
d26ce60c-2151-403c-9a42-49420d87b5e4 sigma
d36f87ea-c403-44d2-aa79-1a0ac7c24456 sigma
d7a95147-145f-4678-b85d-d1ff4a3bb3f6 sigma
d9047477-0359-48c9-b8c7-792cedcdc9c4 sigma
de7ce410-b3fb-4e8a-b38c-3b999e2c3420 sigma
f0d1feba-4344-4ca9-8121-a6c97bd6df52 sigma
… and 6 more in the database

Tested by 8

004a5d68-627b-452d-af3d-43bd1fc75a3b atomic
2382dee2-a75f-49aa-9378-f52df6ed3fb1 atomic
31eb7828-97d7-4067-9c1e-c6feb85edc4b atomic
873106b7-cfed-454b-8680-fa9f6400431c atomic
a5d8cdeb-be90-43a9-8b26-cc618deac1e0 atomic
b8db787e-dbea-493c-96cb-9272296ddc49 atomic
bf07f520-3909-4ef5-aa22-877a50f2f77b atomic
edbcd8c9-3639-4844-afad-455c91e95a35 atomic

Lab findings

Measured in the isolated detection lab (Wazuh / Sysmon / auditd). Each run detonates a benign emulation of the technique and grades what the SIEM saw.

Run	Outcome	Tool	Platform	Ran at
`run-2026-10-20-013`	partially-detected	atomic	windows	2026-10-20
`run-2026-11-02-019`	detected	atomic	windows	2026-11-02

run-2026-10-20-013 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1569.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=0 incidental=2784 max_level=15 dwell_s=90
run-2026-11-02-019 — Backlog detectability-baseline probe (priority 5, 1 corpus attack(s); atomic_tests=8). No lab analytic covers this technique yet, so expected_wazuh_rules is empty and the grade is the true measured detectability: a bundled rule tagged T1569.002 firing is a real 'detected', nothing firing is a real coverage gap for the detection loop. Signals: MITRE documents a detection strategy.; expected=2 incidental=32 max_level=15 dwell_s=90

Framework references

Primary source: https://attack.mitre.org/techniques/T1569/002/
attack: T1569.002 (primary)

Evidence & sources

ev-0001 (Cyber Attack Taxonomy) — Name, definition and Example/ID taken verbatim from the 'Network and infrastructure attacks' table, line 199 of Cyber-Attack-Taxonomy.md
ev-0002 (MITRE Enterprise ATT&CK v19.2 (STIX 2.1)) — ATT&CK usage prevalence: 72 groups/software/campaigns reference this technique (ATT&CK enterprise v19.2)
ev-0003 (Phase 4 detection lab - detonation runs 2026-10-20) — Lab detonation run-2026-10-20-013 (partially-detected) for T1569.002: no alert matched the expected technique
ev-0004 (Phase 4 detection lab - detonation runs 2026-11-02) — Lab detonation run-2026-11-02-019 (detected): Wazuh rule(s) 100446, 100447 fired on T1569.002 within the detonation window
Service Control Manager DACL opened to a broad group (sc sdset scmanager granting write/full rights to Everyone/Users) -- T1569.002