text: Petya: disabling remote execution of psexec – Guy Leech's Blog
  Author guyrleechPosted on June 28, 2017 Categories SecurityTags ifeo, notpetya, petya, psexec, psexesvc
  8 thoughts on "Petya: disabling remote execution of psexec"
  June 30, 2017 at 16:55
  Your solution will work for psexec versions prior to 2.1+ after that MS included a switch -r that allows you to change the service process name.
  If you are not using the Administrative shares like admin$ then disabling them on client machines will block psexec regardless of the process name. Beware, it will also block other apps remotely connecting and creating services.
  Create a new DWORD value here, named AutoShareServer. Leave its value data as 0
  Create a new DWORD value here, named AutoShareWks. Leave its value data as 0
  Would it be possible to use Software Restriction Policies to prevent PsExec.exe from running? You'd have to have the file hashes for every version of PsExec.exe but that can probably be found somehow.
  The trouble with specific blacklisting is that you are always playing catch-up. You only need to change 1 bit of a byte, in say a text string that doesn't affect the program's operation and you've got a completely different file hash.
  Does Psexec64.exe spawn the same service name on the remote machines? Do we need separate keys for it as well?
  I believe that it creates the same service name regardless of whether it is psexec or psxec64 so one IFEO entry should kill it
  What about preventing write access to the HKEY_LOCAL_MACHINE\System\CurrentControlSet\Services key by permission (deny everyone "create subkey", this key only) . If you can't create any new "service" than any name psexec wanted to use wouldn't work. I'm unsure of how this would affect windows running, I don't think it needs to create services on the fly.
  Where you say "I'm unsure of how this would affect windows running" is what I would've said if you hadn't mentioned it – would probably cause problems when patching, upgrading, etc. You could try but test it thoroughly.