Guided lab: a service that existed for nine seconds
Remote execution over the admin share, reconstructed from the target. Tie four events in three logs into one action, work back to the host it came from, and handle the version where the service is not called PSEXESVC.
The call
2026-09-03. PELL-FS-03 at Pellwick Dairy Cooperative shows a process tree the application owner does not recognise: a command prompt running as SYSTEM with no interactive session behind it. You have the Security and System logs from the server.
Artifact 1: four events, three seconds
16:20:41 Security 4624 Logon Type: 3 Account: PELLWICK\adm.lindqvist
Source Network Address: 10.58.6.92 Logon ID: 0x62343E6
Authentication Package: NTLM
16:20:42 Security 5145 Share Name: \\*\ADMIN$ Relative Target Name: mssvc.exe
Accesses: WriteData (or AddFile) Account: adm.lindqvist
Source Address: 10.58.6.92 Logon ID: 0x62343E6
16:20:43 System 7045 Service Name: mssvc Service File Name: %SystemRoot%\mssvc.exe
Service Type: user mode service Start Type: demand start
Account: LocalSystem
16:20:44 Security 4688 New Process: C:\Windows\mssvc.exe Creator: C:\Windows\System32\services.exe
16:20:44 Security 4688 New Process: C:\Windows\System32\cmd.exe Creator: C:\Windows\mssvc.exe
Token Elevation: Full Account: SYSTEM
Q1
Put the four stages into one sentence describing a single action. Which field proves that the logon and the file write belong to the same session?
Stuck? Where to look
One value appears in two of the Security events.
Show the answer
adm.lindqvist authenticated to PELL-FS-03 over the network from 10.58.6.92, wrote an executable into the Windows directory through the ADMIN$ share, registered it as a service, and started it, which gave them a command prompt as SYSTEM.
The Logon ID, 0x62343E6, appears in both the 4624 and the 5145. That is
what turns "a logon, and then a file write" into "this logon wrote that file".
Without it you have adjacency, which is an assessment. With it you have an
observation.
Q2
The service is called mssvc, not PSEXESVC. A colleague says that rules this out as PsExec. Are they right, and does it matter?
Stuck? Where to look
Read the documentation for the tool's command line options, and then ask which parts of this pattern a name change affects.
Show the answer
They are wrong about the tool and it barely matters. PsExec has an option to name its remote service, and Impacket's equivalents, among others, choose random names by default. The service name is the one part of this pattern the operator controls completely.
What they do not control is the shape: a network logon, a write to ADMIN$, a 7045 for a demand-start LocalSystem service whose binary sits directly in the Windows directory, and that binary spawning a shell, all within seconds. Detect the shape. A rule that looks for the string PSEXESVC finds administrators and misses operators.
Q3
The logon is type 3 with NTLM. What does that tell you about whether adm.lindqvist's credentials are now recoverable from PELL-FS-03's memory, and how would the answer change if the tool had been given an explicit username and password?
Stuck? Where to look
Logon types differ in what they leave behind on the target. Compare a network logon with an interactive one.
Show the answer
A type 3 network logon does not leave reusable credentials on the target. The server verified a challenge response and never held the password or the hash, so dumping LSASS on PELL-FS-03 afterwards does not yield adm.lindqvist.
If PsExec is run with an explicit username and password, it logs that account on at the far end so the process can run as that user, which is an interactive-style logon, and the credentials are then present in memory on the target. That is the version that spreads a privileged credential to every server it touches.
NTLM rather than Kerberos is worth a note of its own. It often means the target was addressed by IP, and it is what pass-the-hash looks like, because a hash can answer an NTLM challenge and cannot request a Kerberos ticket.
Q4
The title says the service existed for nine seconds. The 7045 is still in the System log. What would you expect to find, and not find, on the server now, and where do you go next?
Stuck? Where to look
These tools tidy up after themselves. Think about which records are a side effect of the action and which are the action.
Show the answer
Expect the service to be gone from the registry and mssvc.exe to be deleted
from the Windows directory. Cleanup is part of how these tools exit. Expect the
7045 to remain, because logs are not part of the cleanup, and expect the USN
journal to hold the file's creation and deletion if it has not rolled.
Do not spend long on the server. The more important host is 10.58.6.92. Go to HR-WS-002 and look for event 4648 at 16:20:41: a logon using explicit credentials, recorded on the source, which names the account that was actually logged on there when adm.lindqvist's credentials were used. That account is where this started.
What to do with it
Observed: a network logon by adm.lindqvist from 10.58.6.92, a write to ADMIN$ under the same logon ID, a service install, and a SYSTEM shell. Assessed: remote execution with a PsExec-style tool using adm.lindqvist's hash or password. Unknown: how those credentials were obtained, which is the question HR-WS-002 answers.
The Sigma endpoint pack includes a 7045 rule for service binaries in suspicious paths. Pair it with a control: administrators should not be able to authenticate from ordinary workstations to servers at all.
Argue underneath
Your own administrators use PsExec every day. Do you ban it, allow it from named management hosts only, or accept the noise? Pick one and defend it against the person who has to do the patching.
Sources
The scenario above is invented. These are what its real half rests on.
- MITRE ATT&CK T1021.002, Remote Services: SMB/Windows Admin Shares
- MITRE ATT&CK T1569.002, System Services: Service Execution
- Microsoft Learn: PsExec
- Microsoft Learn: 5145, A network share object was checked
- Microsoft Learn: 4624, An account was successfully logged on
- Microsoft Learn: 4648, A logon was attempted using explicit credentials
- Microsoft Learn: 4697, A service was installed in the system
Discussion
GuidelinesSign in to comment. Corrections and additions are the point: this is a working document.