cypherpunk-remote-exec-w-psexesvc

id: 6941f6b3-9e08-4f45-ac26-fe4a23d4d613
name: cypherpunk-remote-exec-w-psexesvc
description: |
  This query was originally published in the threat analytics report, Cypherpunk ransomware leaves wake of tampered AVs.
  Cypherpunk is a human-operated ransomware campaign named after the unusual .cypherpunk extension given to encrypted files. The attackers often used PSEXESVC, a service that helps the PsExe.exe utility run commands on a remote device. Both PSEXESVC and PsExe.exe are legitimate parts of Windows; however, they can be repurposed by attackers to perform malicious actions.
  The query below can find instances of PSEXESVC being used to launch batch files, as often occurred in Cypherpunk attacks.
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceProcessEvents
tactics:
- Execution
- Ransomware
query: |
  // Searches for remote batch file launch using PSEXESVC.exe
  DeviceProcessEvents
  | where InitiatingProcessParentFileName startswith "psexe"
  | where InitiatingProcessCommandLine has ".bat"
  | where ProcessCommandLine has "DisableIOAVProtection"