How to Corroborate PsExec Activity with Windows Forensic Artifacts

Summary

The article demonstrates how investigators can correlate Windows registry data, BAM, Prefetch, and Event ID 7045 to build a more reliable timeline and context for suspected PsExec lateral movement.

Key points

The author recommends triangulating evidence from multiple telemetry sources rather than relying on a single artifact or assumption.
The example combines PsExec registry EULA data, Background Activity Moderator (BAM), Prefetch, and target-machine Event ID 7045 records.
Registry EULA data can associate PsExec with a user SID but does not establish when it ran.
BAM can provide an executable path, execution time, and associated user, but trusts the executable name.
Prefetch can show execution frequency and referenced directories, but does not identify the user and also trusts the executable name.
The target machine’s PsExeSVC Prefetch record and Event ID 7045 can help corroborate timing, unless the service name was changed.
In the example, the combined evidence supported the JEyre account, the C:\Users\JEyre\Downloads\PsTools directory, and an activity window of April 4, 2022, 02:32–03:17 UTC.

Article Details

Defense Focus: Corroborate suspected PsExec lateral movement by combining independent forensic telemetry and accounting for each source's limitations.
Detection Methods: Check the target machine's System.evtx for Event ID 7045 service-installation events referencing PsExeSVC.exe; correlate the event time and user SID with other evidence.
Inspect HKEY_USERS\S-*\Software\Sysinternals\PsExec for EulaAccepted, which indicates PsExec was present and its EULA accepted for the associated user.
Parse Background Activity Moderator (BAM) data to identify an executed program's path, execution time, and associated SID or user account.
Parse Prefetch files on both the host and target to assess execution frequency, paths, and timing; correlate target-side PsExeSVC.exe evidence with the service event.
Data Sources: Windows registry, including the Sysinternals PsExec EulaAccepted key
Background Activity Moderator (BAM) registry data
Prefetch .PF files on the host and target
Target machine System.evtx, Event ID 7045
Platforms: Windows
Windows Server
Defensive Actions: Correlate timestamps, user SIDs, execution paths, and Prefetch run counts across the registry, BAM, Prefetch, and System event logs before concluding that activity was malicious.
Treat executable names in BAM and Prefetch as unverified: renamed executables may be recorded under their new names.
Account for the possibility that PsExec's service name was changed with the -r flag when searching for PsExeSVC.exe.
When Prefetch is unavailable, consider Amcache and Shimcache as alternative artifacts; the article notes that Prefetch is automatically disabled on Windows Servers but can be enabled.