tool
xCmd is an open source tool that is similar to PsExec and allows the user to execute applications on remote systems. [1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
95th percentile · 95% of 825 ATT&CK software entries have this many detection rules per technique or fewer.
55 distinct rules cover the 1 technique recorded for this tool. 45 Sigma · 10 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...) | Generic | test | service | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems), Wojciech Lesicki | 2021-05-26 | 2022-11-27 | d7a95147-145f-4678-b85d-d1ff4a3bb3f6 | ||||
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...) | Generic | test | service | windows | WinEventLog System | - | critical | Florian Roth (Nextron Systems), Wojciech Lesicki | 2021-05-26 | 2022-11-27 | 5a105d34-05fc-401e-8553-272b45c1522d | ||||
Detects the installation of a service named "javamtsup" on the system. (...) | Emerging | test | service | windows | WinEventLog Security | - | critical | Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update) | 2017-03-27 | 2022-10-09 | cb062102-587e-4414-8efa-dbe3c7bf19c6 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog Security | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | f0d1feba-4344-4ca9-8121-a6c97bd6df52 | ||||
Detects well-known credential dumping tools execution via service execution events | Generic | test | service | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community | 2017-03-05 | 2022-11-29 | 4976aa50-8f41-45c6-8b15-ab3fc10e79ed | ||||
Detects default CSExec service filename which indicates CSExec service installation and execution | Generic | test | file_event | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-08-04 | — | f0e2b768-5220-47dd-b891-d57b96fc0ec1 | ||||
Detects CSExec service installation and execution events | Generic | test | service | windows | WinEventLog System | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-08-07 | — | a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12 | ||||
Identifies clients that may be performing DNS lookups associated with common currency mining pools. | Generic | test | - | - | DNS · Zeek | - | low | Saw Winn Naung, Azure-Sentinel, @neu5ron | 2021-08-19 | 2022-07-07 | bf74135c-18e8-4a72-a926-0e4f47888c19 | ||||
Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub pro (...) | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | critical | Florian Roth (Nextron Systems) | 2020-07-15 | 2022-07-12 | b5281f31-f9cc-4d0d-95d0-45b91c45b487 | |||||
Splunk | The following analytic detects excessive usage of the `sc.exe` service utility on a host machine. (...) | Anomaly | stable | process_creation | windows | Sysmon | - | medium | Teoderick Contreras, Splunk | 2021-06-24 | 2026-05-13 | cb6b339e-d4c6-11eb-a026-acde48001122 | |||
Splunk | The following analytic detects the first occurrence of a Windows service running in your environment. (...) | Anomaly | experimental | service | windows | WinEventLog System | - | medium | David Dorsey, Splunk | 2019-10-16 | 2026-05-13 | 823136f2-d755-4b6d-ae04-372b486a5808 | - | ||
Detects the use of SharpUp, a tool for local privilege escalation | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | critical | Florian Roth (Nextron Systems) | 2022-08-20 | 2023-02-13 | c484e533-ee16-4a93-b6ac-f0ea4868b2f1 | ||||
Detects installation or execution of services | Generic | test | service | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems) | 2022-03-21 | 2023-08-07 | d26ce60c-2151-403c-9a42-49420d87b5e4 | ||||
Splunk | The following analytic detects the suspicious service started. (...) | Anomaly | stable | process_creation | linux | Linux Auditd | - | medium | Teoderick Contreras, Splunk | 2024-08-12 | 2026-05-13 | b5eed06d-5c97-4092-a3a1-fa4b7e77c71a | |||
Splunk | The following analytic identifies the execution of malicious PowerShell commands or payloads via the Windows SC.exe utility. (...) | Generic | stable | service | windows | WinEventLog System | - | medium | Ryan Becwar | 2021-04-13 | 2026-05-13 | 8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8 | |||
Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities. | Unsupported | unsupported | service | windows | WinEventLog System | - | critical | Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update) | 2017-03-27 | 2022-03-21 | 2cfe636e-317a-4bee-9f2c-1066d9f54d1a | ||||
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...) | Unsupported | unsupported | service | windows | WinEventLog System | - | high | Bartlomiej Czyz, Relativity | 2021-01-21 | 2022-03-21 | 1a17ce75-ff0d-4f02-9709-2b7bb5618cf0 | ||||
Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...) | Generic | test | service | windows | WinEventLog Security | - | high | Bartlomiej Czyz, Relativity | 2021-01-21 | 2022-10-05 | 6fb63b40-e02a-403e-9ffd-3bcc1d749442 | ||||
Windows DCE-RPC functions which indicate an execution techniques on the remote system. (...) | Generic | test | - | - | DCE/RPC · Zeek | - | medium | @neu5ron, SOC Prime | 2020-03-19 | 2021-11-27 | b640c0b8-87f8-4daa-aef8-95a24261dd1d | ||||
Detects PAExec service installation | Generic | test | service | windows | WinEventLog System | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-10-26 | — | de7ce410-b3fb-4e8a-b38c-3b999e2c3420 | ||||
Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | Wojciech Lesicki | 2021-06-29 | 2024-03-25 | 61a7697c-cb79-42a8-a2ff-5f0cdfae0130 | ||||
Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (...) | Emerging | test | process_creation | windows | Sysmon · WinEventLog Security | high | Florian Roth (Nextron Systems) | 2022-04-13 | 2023-02-03 | a7cd7306-df8b-4398-b711-6f3e4935cf16 | |||||
Detects that a powershell code is written to the registry as a service. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | oscd.community, Natalia Shornikova | 2020-10-06 | 2023-08-17 | 4a5f5a5e-ac01-474b-9b4e-d61298c9df1d | ||||
Detects powershell script installed as a Service | Generic | test | service | windows | WinEventLog System | - | high | oscd.community, Natalia Shornikova | 2020-10-06 | 2022-12-25 | a2e5019d-a658-4c6a-92bf-7197b54e2cae | ||||
Detects powershell script installed as a Service | Generic | test | service | windows | WinEventLog Security | - | high | oscd.community, Natalia Shornikova | 2020-10-06 | 2022-11-29 | 2a926e6a-4b81-4011-8a96-e36cc8c04302 | ||||
Detects a ProcessHacker tool that elevated privileges to a very high level | Generic | test | service | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems) | 2021-05-27 | 2022-12-25 | c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9 | ||||
Detects blocking of process creations originating from PSExec and WMI commands | Generic | test | - | windows | Windows Defender | - | high | Bhabesh Raj | 2020-07-14 | 2022-12-25 | 97b9ce1e-c5ab-11ea-87d0-0242ac130003 | ||||
Detects PsExec service default pipe creation | Hunting | test | pipe_created | windows | Sysmon | - | low | Thomas Patzke | 2017-06-12 | 2022-10-09 | f3f3a972-f982-40ad-b63c-bca6afdfad7c | ||||
Detects default PsExec service filename which indicates PsExec service installation and execution | Generic | test | file_event | windows | Sysmon | - | low | Thomas Patzke | 2017-06-12 | 2022-10-26 | 259e5a6a-b8d2-4c38-86e2-26c5e651361d | ||||
Detects PsExec service installation and execution events | Generic | test | service | windows | WinEventLog System | - | medium | Thomas Patzke | 2017-06-12 | 2023-08-04 | 42c575ea-e41e-41f1-b248-8093c3e82a28 | ||||
Detects PsExec default pipe creation where the image executed is located in a suspicious location. (...) | Generic | test | pipe_created | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-08-04 | 2023-09-20 | 41504465-5e3a-4a5b-a5b4-2a0baadd4463 | ||||
Detects default CSExec pipe creation | Generic | test | pipe_created | windows | Sysmon | - | medium | Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-08-07 | 2023-11-30 | f318b911-ea88-43f4-9281-0de23ede628e | ||||
Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-08-22 | 2023-02-21 | d08a2711-ee8b-4323-bdec-b7d85e892b31 | ||||
Detects the use of NirCmd tool for command execution, which could be the result of legitimate admini (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2022-01-24 | 2023-02-13 | 4e2ed651-1906-4a59-a78a-18220fca1b22 | ||||
Detects the use of NirCmd tool for command execution as SYSTEM user | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2022-01-24 | 2023-02-13 | d9047477-0359-48c9-b8c7-792cedcdc9c4 | ||||
Detects the use of NSudo tool for command execution | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali | 2022-01-24 | 2023-02-13 | 771d1eb5-9587-4568-95fb-9ec44153a012 | ||||
Detects PAExec default named pipe | Generic | test | pipe_created | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2022-10-26 | — | f6451de4-df0a-41fa-8d72-b39f54a08db5 | ||||
Detects default RemCom pipe creation | Generic | test | pipe_created | windows | Sysmon | - | medium | Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems) | 2023-08-07 | 2023-11-30 | d36f87ea-c403-44d2-aa79-1a0ac7c24456 | ||||
Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Florian Roth (Nextron Systems) | 2022-01-24 | 2023-02-14 | 93199800-b52a-4dec-b762-75212c196542 | ||||
Detects default RemCom service filename which indicates RemCom service installation and execution | Generic | test | file_event | windows | Sysmon | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-08-04 | — | 7eff1a7f-dd45-4c20-877a-f21e342a7611 | ||||
Detects RemCom service installation and execution events | Generic | test | service | windows | WinEventLog System | - | medium | Nasreddine Bencherchali (Nextron Systems) | 2023-08-07 | — | 9e36ed87-4986-482e-8e3b-5c23ffff11bf | ||||
Detects service installation of different remote access tools software. (...) | Generic | test | service | windows | WinEventLog Security | - | medium | Connor Martin, Nasreddine Bencherchali (Nextron Systems) | 2022-12-23 | 2024-12-07 | c8b00925-926c-47e3-beea-298fd563728e | ||||
Detects service installation of different remote access tools software. (...) | Generic | test | service | windows | WinEventLog System | - | medium | Connor Martin, Nasreddine Bencherchali | 2022-12-23 | 2023-06-22 | 1a31b18a-f00c-4061-9900-f735b96c99fc | ||||
Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR | Generic | test | - | - | RPC Firewall | - | high | Sagie Dulce, Dekel Paz | 2022-01-01 | — | 10018e73-06ec-46ec-8107-9172f1e04ff2 | ||||
Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Bartlomiej Czyz, Relativity | 2021-01-31 | 2023-02-28 | 5bb68627-3198-40ca-b458-49f973db8752 | ||||
Detects known malicious service installation that appear in cases in which a Sliver implants execute (...) | Generic | test | service | windows | WinEventLog System | - | high | Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) | 2022-08-25 | — | 31c51af6-e7aa-4da7-84d4-8f32cc580af2 | ||||
Detects the use of smbexec.py tool by detecting a specific service installation | Generic | test | service | windows | WinEventLog System | - | high | Omer Faruk Celik | 2018-03-20 | 2023-11-09 | 52a85084-6989-40c3-8f32-091e12e13f09 | ||||
Detects the usage of the "net.exe" command to start a service using the "start" flag | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community | 2019-10-21 | 2023-03-05 | 2a072a96-a086-49fa-bcb5-15cc5a619093 | ||||
Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events. | Generic | experimental | registry_set | windows | Sysmon · WinEventLog Security | - | medium | Frack113 | 2025-10-23 | — | 1f1d8209-636e-4c6c-a137-781cca8b82f9 | ||||
Splunk | The following analytic detects changes in the ScManager service security descriptor settings. (...) | Generic | stable | process_creation | windows | Sysmon · WinEventLog Security · CrowdStrike | - | medium | Nasreddine Bencherchali, Michael Haag, Splunk | 2024-12-06 | 2026-10-02 | 04023928-0381-4935-82cb-03372b2ef644 |
72nd percentile · 72% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
97th percentile · 97% of 825 ATT&CK software entries have this many mitigations per technique or fewer.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 1 Enterprise technique.
Technique Campaign use over its cumulative rule count.