{
  "family": "psexec",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nPsExec is a perfectly legitimate, highly powerful command-line utility created by Microsoft Sysinternals. It allows system administrators to execute processes on remote Windows systems without having to manually install client software. However, due to its immense power and \"living off the land\" nature, PsExec is one of the most heavily abused tools by threat actors, ransomware gangs, and APT groups to facilitate rapid lateral movement and automated payload deployment across compromised networks.\n\n<h3>Technical Capabilities and Malicious Abuse</h3>\nPsExec operates using the Server Message Block (SMB) protocol. It connects to the hidden `ADMIN$` share on the target machine, uploads a lightweight service executable (`PSEXESVC.exe`), and starts it via the Windows Service Control Manager (SCM). This service then executes the requested command.\n\nThreat actors exploit this functionality after they have compromised an administrative account:\n<ul>\n<li><strong>Lateral Movement:</strong> Once an attacker dumps credentials (e.g., using Mimikatz) and obtains a Domain Admin hash, they use PsExec (or heavily modified clones like Impacket's `psexec.py`) to \"pass the hash.\" This allows them to instantly gain interactive command-line access to any server or workstation in the domain without cracking the actual password.</li>\n<li><strong>Ransomware Deployment:</strong> Ransomware operators (such as Ryuk or Conti) frequently write scripts that loop through lists of all active IP addresses on the corporate network, utilizing PsExec to push the ransomware executable to every machine simultaneously, ensuring maximum destruction before defenders can react.</li>\n<li><strong>Evasion:</strong> Because PsExec is a Microsoft-signed administrative tool, its execution is often ignored by legacy antivirus solutions, making it an ideal \"fileless\" execution vector.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of PsExec execution is highly context-dependent. If it is used by a known administrator from a jump server to patch a system, it is benign. If it is executed from an unexpected endpoint (like a receptionist's PC) at 3:00 AM to launch a randomly named executable on a domain controller, it is a critical indicator of a major breach in progress.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Monitoring (EDR):</strong> Security teams must tune their EDR solutions to aggressively monitor the usage of PsExec. Alerts should trigger if PsExec is launched by non-administrative accounts, or if it is used to execute known malicious binaries, PowerShell scripts, or batch files.</li>\n<li><strong>Network Segmentation (SMB):</strong> Limit lateral movement by heavily restricting SMB traffic (TCP Port 445) between workstations. Only allow designated administrative jump boxes to initiate SMB connections to endpoints.</li>\n<li><strong>Credential Tiering:</strong> Implement the Microsoft Tiered Admin Model to prevent Domain Admin credentials from being cached on standard workstations, denying attackers the high-privileged accounts required to abuse PsExec across the enterprise.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.PsExec",
    "Sysinternals.PsExec",
    "LateralMovement.Tool"
  ],
  "enrichment_level": "insufficient_information",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1569.002",
    "T1021.002",
    "T1570",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-07-01T17:20:25Z",
  "type": "HackTool (Dual-Use)",
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}