How do you detect smbexec?

Detect smbexec by inspecting the service ImagePath in Event ID 7045 (System) and 4697 (Security): the tool creates a service whose binary path is a cmd.exe command line using %COMSPEC%, /Q /c, echo and output redirection, then deletes it, repeating the cycle for every command. Match the command-line shape rather than a service name, since forks randomise names. Count bursts of service creates per host and source, add Sysmon 11 and 23 for the temporary .bat file, and correlate Event 5145 writes then reads of the output file on C$ or ADMIN$. Legitimate services almost never point ImagePath at a shell, so this rule has a low false-positive rate once baselined.

Detecting smbexec and Impacket Service-Based Command Execution

Where PsExec uploads an executable, smbexec avoids touching disk with a payload: it creates a service whose binary path is a cmd.exe command line, runs it, then deletes the service. Each command repeats the cycle, which makes the pattern noisy in the very logs defenders already collect.

Signals at a Glance

Signal	Where	ATT&CK
Service ImagePath containing %COMSPEC%, cmd.exe /Q /c or echo redirected into a file	Event 7045 / 4697	T1569.002
Repeated service create and delete cycles from one source in minutes	System log, Sysmon 13	T1543.003
Temporary .bat file created and executed then removed	Sysmon 11/23	T1059.003
Output file written to a share such as C$ or ADMIN$ and read back	Event 5145, Zeek smb	T1021.002
cmd.exe launched by services.exe with /Q /c	Sysmon 1, Event 4688	T1059.003

The ImagePath Is the Payload

The default smbexec flow builds a service binary path along the lines of %COMSPEC% /Q /c echo <command> ^> \\127.0.0.1\C$\__output 2^>^&1 > %TEMP%\execute.bat & %COMSPEC% /Q /c %TEMP%\execute.bat & del %TEMP%\execute.bat. Older builds also used a fixed service name; newer ones and forks randomise it, so match on the command-line shape:

title: Service ImagePath Executes Command Interpreter With Redirection
logsource:
  product: windows
  service: system
detection:
  selection:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
  interpreter:
    ImagePath|contains:
      - '%COMSPEC%'
      - 'cmd.exe /Q /c'
      - 'cmd /c echo'
      - 'powershell'
  redirect:
    ImagePath|contains:
      - '\\127.0.0.1\'
      - '__output'
      - '.bat'
  condition: selection and interpreter and redirect
level: high
# tune/validate: legitimate services almost never point ImagePath at a shell; confirm in your estate.

Because every command creates and removes a service, volume is itself a signal. Count 7045 and 7036 events per host and source:

// Sentinel (KQL) - bursts of service creation on one host (smbexec per-command cycle)
SecurityEvent
| where EventID == 4697
| where ServiceFileName has_any ("%COMSPEC%", "cmd.exe", "powershell")
| summarize installs=count(), names=dcount(ServiceName), first=min(TimeGenerated), last=max(TimeGenerated)
          by Computer, SubjectUserName, bin(TimeGenerated, 10m)
| where installs >= 3
// tune/validate: the per-command cycle means one interactive session produces many events.

Batch Files, Output and Cleanup

Look for a .bat in a temp path, created and executed within one second and deleted shortly after. Sysmon 11 plus Sysmon 23 (file delete) captures the sequence.
The output file lands on a share and is read over SMB by the same client. Event 5145 with a write then a read on the same relative target name from one source is a tight correlation.
A SERVER-mode variant hosts a local SMB server to avoid the share write; in that case the network side shows the target connecting back to the operator host on 445, which is rare for servers.
Because the service runs as SYSTEM, the child cmd.exe will too. Alert on SYSTEM interpreters whose parent is services.exe and whose command line contains /Q.

Vetted sources

SigmaHQ includes rules for suspicious service ImagePaths and Impacket smbexec patterns, and Elastic and Splunk ESCU carry equivalent service-creation content. MITRE CAR documents remote service analytics, and Atomic Red Team lets you replay the behaviour. Baseline your own environment, and note that Zeek smb logs help where host auditing is incomplete.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

The ImagePath Is the Payload

Batch Files, Output and Cleanup

Build Detections That Fire

Lateral Movement Detection

Detection Hub

PsExec Detection

Remote Service Creation Detection