PsExec
PsExec is a legitimate Microsoft Sysinternals remote administration utility that is widely abused by threat actors for remote command execution and lateral movement in Windows environments. The provided content consistently describes PsExec being used to copy and launch binaries through SMB administrative shares such as ADMIN$ and C$, often by creating the PSEXESVC service or other remote services; Windows System Event ID 7045 is repeatedly identified as a primary indicator of PsExec-based lateral movement and service installation. The tool can also be used with the -s argument to run as SYSTEM, and some malware embeds and drops a copy of PsExec (for example to C:\Temp\psexec.exe). The content associates PsExec with ransomware propagation and post-compromise operations by multiple actors and campaigns, including Conti, Black Basta, Akira, LockBit, GOLD SALEM / Storm-2603 during Warlock ransomware intrusions, The Gentlemen ransomware, BlackCat/ALPHV-affiliated activity, and NotPetya. Observed tradecraft includes use alongside Mimikatz, Impacket, WMIC/WMI, WinRM, Cobalt Strike, administrative shares, and Group Policy Objects to spread payloads, execute commands remotely, and encrypt additional systems. Detection-relevant artifacts mentioned in the content include the PSEXESVC service, executable staging to administrative SMB shares, renamed PsExec binaries, command lines containing accepteula, paths such as C:\Intel\PsExec.exe and C:\Temp\psexec.exe, and IOC references including PsExec hashes.
Hunt this family in your stack
Mallory pivots from this family to the IOCs, detections, and named campaigns that touch your stack, and pages you when something new lands.
Groups observed using it
36 distinct threat actors attributed by public researchers. Open in Mallory to see the full evidence chain and overlapping campaigns.
Microsoft also observed the use of PsExec and Impacket for lateral movement and the use of Group Policy Objects (GPO) to deploy the Warlock payload.
Prominent among the other tools used by Twelve are Cobalt Strike, Mimikatz, Chisel, BloodHound, PowerView, adPEAS, CrackMapExec, Advanced IP Scanner, and PsExec for credential theft, discovery, network mapping, and privilege escalation.
GOLD SALEM has been observed using PsExec and Impacket (WMI) for lateral movement within compromised environments.
"...publicly available utilities like PsExec, to move laterally within compromised networks."
"The actor was also observed to use PsExec to encrypt devices that are not hosted on the ESXi hypervisor."
Techniques & procedures
12 distinct techniques documented for this family, organized by ATT&CK tactic.
Initial Access
3 techniques
Initial Access
Execution
2 techniques
Execution
Persistence
4 techniques
Persistence
GPP XML artifacts revealing DSSAT domain-admin accounts, including Admin_APS4, SCCMSystemgroup and CMClientPushSrv; use of RCIVIL\maturano credentials for PsExec lateral movement.
Privilege Escalation
3 techniques
Privilege Escalation
Stealth
2 techniques
Stealth
Credential Access
1 technique
Credential Access
Lateral Movement
4 techniques
Lateral Movement
T1021 Remote Services Native remote services are abused for lateral movement. LoTL usage ▸ FIN7 used PsExec across banking networks ▸ Carbanak relied on RDP and SMB for internal spread
ls \\192.168.13.100\C$\Users\Administrator\Desktop cat \\192.168.13.100\C$\Users\Administrator\Desktop\flag5.txt | What Event ID in the System log is the primary indicator of PsExec-based lateral movement? 7045
IOCs tracked for this family
2 indicators attributed across vendor reports, sandbox runs, and researcher write-ups. Full values are available in Mallory.
IPs, domains, and DNS infrastructure linked to this family.
File hashes (MD5, SHA-1, SHA-256) from samples and reports.
Recent activity
51 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
Легитимный инструмент удалённого администрирования, используемый для lateral movement через SMB/Admin$ и запуска полезной нагрузки на удалённых системах; в тексте прямо указан как основной инструмент распространения ransomware у ряда групп.
PsExec is used for lateral movement and remote command execution, including obtaining a shell on the domain controller after pass-the-hash authentication.
Legitimate remote execution utility abused for lateral movement and, in the described attack chain, for spreading ransomware.
Legitimate Sysinternals remote execution tool embedded and used by The Gentlemen to execute payloads remotely during lateral movement and propagation.
The version that knows your environment.
Match every observed IP, domain, and hash against your live telemetry.
Named campaigns wielding this family, with evidence pinned to each claim.
CVEs this family uses for access and lateral movement.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Every documented technique, ranked by evidence weight.
Reddit, Mastodon, and CTI community discussion around this family.