PsExec
PsExec is a legitimate Microsoft Sysinternals remote administration utility that is frequently abused by threat actors for remote command execution and lateral movement in Windows environments. Across the provided content, it is repeatedly associated with SMB/administrative share usage, remote service creation and execution, lateral tool transfer, and installation of the PSEXESVC service. It is commonly used alongside credential theft tools such as Mimikatz and with WMI/WMIC or Impacket after initial access via phishing, exploitation of public-facing applications, stolen VPN credentials, or other footholds.
The content shows PsExec used broadly in ransomware intrusions and enterprise compromises. Multiple ransomware operators and affiliates are described using PsExec for lateral movement and remote deployment, including BlackCat/ALPHV affiliates, Interlock, The Gentlemen, Storm-2603, and other RaaS actors. Reported use cases include copying and executing ransomware via batch scripts, encrypting remote Windows devices, deploying payloads through administrative shares, and distributing malware or ransomware through services or Group Policy. The Gentlemen ransomware notably embeds or drops PsExec, stages it to C:\Temp\psexec.exe, and when spreading is enabled attempts numerous remote execution operations per target using PsExec, WMIC, scheduled tasks, services, PowerShell remoting, and WMI. Interlock used hardcoded PsExec commands with compromised domain administrator credentials for large-scale ransomware deployment. Storm-2603 used PsExec with Impacket and WMI after exploiting on-premises SharePoint vulnerabilities, then distributed Warlock ransomware via Group Policy Objects.
The content also ties PsExec to destructive and worm-like malware behavior. NotPetya contained an embedded PsExec tool and used stolen credentials with PsExec and WMIC to propagate laterally across internal Windows networks after initial distribution through the compromised MeDoc update mechanism. In other intrusions, actors installed the PSEXESVC service on multiple servers, dropped PsExec binaries to paths such as C:\Intel\PsExec.exe, or used renamed copies to evade detection.
Associated threat actors and groups explicitly mentioned in connection with PsExec include FIN6, Silence, Storm-2603, GOLD SALEM, Volt Typhoon-related tradecraft references, BlackCat/ALPHV affiliates, and multiple ransomware crews such as LockBit, BlackByte, Ryuk, Royal, Akira, and others in ATT&CK-style mappings and detection content. The content also notes that modified or renamed versions of PsExec have been used, including by Silence, and that defenders monitor for renamed PsExec execution and first-time execution with the accepteula flag.
High-confidence indicators and forensic artifacts directly mentioned include the PSEXESVC service, dropped binaries at C:\Temp\psexec.exe and C:\Intel\PsExec.exe, executable staging to ADMIN$, C$, and IPC$ shares, and IOC references containing PsExec hashes. Detection-relevant telemetry cited in the content includes Windows Security Event ID 5145 for executable writes to administrative SMB shares, Event ID 4624 Type 3 network logons, Event ID 4688 and Sysmon Event ID 1 for process creation, and process metadata where the original file name remains PsExec even if the executable has been renamed.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
36 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
The actor moves laterally using PsExec and the Impacket toolkit, executing commands using Windows Management Instrumentation (WMI).
Prominent among the other tools used by Twelve are Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner, and PsExec for credential theft, discovery, network mapping, and privilege escalation.
GOLD SALEM has been observed using PsExec and Impacket (WMI) for lateral movement within compromised environments.
"...publicly available utilities like PsExec, to move laterally within compromised networks."
"The actor was also observed to use PsExec to encrypt devices that are not hosted on the ESXi hypervisor."
Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.
Kimsuky has obtained and used tools such as Nirsoft WebBrowserPassVIew, Mimikatz, and PsExec.
FIN6 has used Metasploit’s PsExec NTDSGRAB module to obtain a copy of the victim's Active Directory database.
Silence has obtained and modified versions of publicly-available tools like Empire and PsExec.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies the execution of PsExec.exe with the accepteula flag in the command line... PsExec is commonly used by threat actors to execute code on remote systems... potentially leading to further system compromise and lateral movement within the network.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
The following analytic identifies instances where PsExec.exe has been renamed and executed on an endpoint. ... renaming PsExec.exe is a common tactic to evade detection. If confirmed malicious, this could allow an attacker to execute commands remotely, potentially leading to unauthorized access, lateral movement, or further compromise of the network.
Techniques & procedures
17 distinct techniques documented for this family, organized by ATT&CK tactic.
Resource Development
3 techniquesAdversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.
The content repeatedly states that threat actors 'obtained,' 'acquired,' or 'used' publicly available, open-source, legitimate, or modified tools such as Mimikatz, Cobalt Strike, PsExec, Empire, Impacket, and many others.
Adversaries may upload tools to third-party or adversary controlled infrastructure to make it accessible during targeting.
Initial Access
2 techniquesT1078.003 - Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Типичная цепочка: Exploit Public-Facing Application (T1190) или фишинг, затем Mimikatz + PsExec для lateral movement, шифрование.
Execution
4 techniquesBefore attempting to run the payload on a remote system, the malware executes the following PowerShell command on the remote target to weaken local defenses... disables Microsoft Defender real-time monitoring, adds broad Defender exclusions, turns off Windows Firewall across all profiles...
Deployment of a batch script named 123.bat was observed on multiple hosts and was deployed via PsExec.
Enterprise T1569 System Services ... enable Attack Surface Reduction (ASR) rules to block processes created by PsExec from running.
Additionally, PSEXESVC.exe was installed on multiple servers.
Persistence
1 techniquePrivilege Escalation
1 techniqueStealth
2 techniquesT1078.003 - Valid Accounts: Local Accounts Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
The malware binary carries an embedded copy of PsExec and drops it to C:\Temp\psexec.exe... If the embedded PsExec payload cannot be extracted successfully, the malware falls back to downloading PsExec directly from Microsoft’s Sysinternals Live service.
Lateral Movement
3 techniquesThe worm systematically attempts 21 distinct remote execution operations against each discovered network host. It relies on diverse utilities including PsExec, WMIC, and remote PowerShell commands.
Play ransomware actors use command-and-control applications such as Cobalt Strike and SystemBC and tools including PsExec to help with lateral movement and file execution
Lateral Tool transfer [T1570]: Primarily correlates to the use of PSexec, which is a legitimate windows administrative tool. Threat actors leverage this tool to move laterally or to mass deploy malware across multiple machines.
Command and Control
2 techniquesWe tried to invoke a notification that would install PsExec using Winget on click. And…it worked! Winget was launched with our command-line switches and installed a program of our choosing
We tried to invoke a notification that would install PsExec using Winget on click.
Impact
1 techniqueRansomware was deployed to the estate and impacted both servers and end-user devices
Other
1 techniqueRecent activity
47 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Legitimate remote execution utility abused for lateral movement and, in the described attack chain, for spreading ransomware.
Legitimate Sysinternals remote execution tool embedded and used by The Gentlemen to execute payloads remotely during lateral movement and propagation.
Инструмент удаленного выполнения, используемый для lateral movement в ransomware-операциях.
PsExec was used for remote command execution and lateral movement across multiple servers by installing the PSEXESVC service.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.