Daily Bytes in DF

Service Installed, Session Opened: Tracing PsExec with Logs and Pipelines.

If it was touched, it can be found

In digital forensics and incident response, PsExec and the concept of the pipeline (specifically within PowerShell and analysis workflows) are frequently intersected when investigators hunt for lateral movement at scale.

PsExec: Forensic Significance and Footprint :.

PsExec is a legitimate Microsoft Sysinternals tool often abused by attackers for remote code execution and lateral movement. Its footprint on a system is distinct and serves as a major indicator of compromise:

• Service Creation: Every time the Sysinternals version of PsExec executes, it installs a temporary service, by default named PSEXESVC. This generates System Event ID 7045 (“A new service was installed”).

• Logon Types: PsExec typically initiates a Logon Type 3 (Network Logon). However, if explicit credentials (-u and -p) are provided in the command line, it creates a Type 3 followed by a Type 2 sequence, which causes credentials (such as hashes) to be cached in the remote system's memory, making them vulnerable to theft by tools like Mimikatz.

• Named Pipes: PsExec uses named pipes for inter-process communication, such as \.\pipe\PSEXESVC or \.\pipe\PSEXESVC-[Hostname]-[PID]-stdin. These can be identified in memory using process handle analysis.

• Artifact Files: Since version 2.30, PsExec creates a temporary file in C:\Windows named PSEXEC-[Originating_System]-[Value].key to mitigate certain vulnerabilities. Though the file is deleted after the session ends, its name often persists in the USN Journal or Prefetch.

The Role of the “Pipeline” in Investigation :.>

The term “pipeline” refers to the method by which data is passed from one command to another for processing, which is central to modern forensic analysis:

• PowerShell Pipelining: PowerShell uses a verb-noun naming scheme where cmdlet output is encapsulated in objects rather than strings. These objects are passed through the pipeline (|) to other cmdlets for filtering or formatting (e.g., Get-Service | Out-GridView).

• Pipeline Logging: Advanced PowerShell logging tracks these operations. Event ID 4103 specifically records Pipeline Execution Details, which can capture variable values, interim command output, and even parts of deobfuscated scripts.

• Analysis Pipelining: When using tools like Volatility, investigators often “pipe” output to Linux utilities to isolate evidence. For example, piping windows.pstree to cut or grep helps an analyst quickly identify anomalous parent-child relationships, such as an explorer.exe process spawning a remote execution tool.

Scaling PsExec Detection via Pipelines :

Investigators use frameworks like Kansa to scale the detection of tools like PsExec across thousands of hosts.

• Kansa uses PowerShell Remoting to run modules in parallel.

• The data returned from these modules is often processed through an analysis pipeline, where scripts like Get-ASEPImagePathLaunchStringMD5UnsignedStack.ps1 perform Least Frequency of Occurrence (LFO) analysis to identify outliers, such as a PsExec service running on only one or two workstations.

• By piping these large datasets through filtering utilities (like Select-String), analysts can pivot from a suspicious service name to the specific host and account involved in the lateral movement.