Psexec
Overview
Executive Summary
PsExec is a perfectly legitimate, highly powerful command-line utility created by Microsoft Sysinternals. It allows system administrators to execute processes on remote Windows systems without having to manually install client software. However, due to its immense power and "living off the land" nature, PsExec is one of the most heavily abused tools by threat actors, ransomware gangs, and APT groups to facilitate rapid lateral movement and automated payload deployment across compromised networks.Technical Capabilities and Malicious Abuse
PsExec operates using the Server Message Block (SMB) protocol. It connects to the hidden `ADMIN$` share on the target machine, uploads a lightweight service executable (`PSEXESVC.exe`), and starts it via the Windows Service Control Manager (SCM). This service then executes the requested command. Threat actors exploit this functionality after they have compromised an administrative account:- Lateral Movement: Once an attacker dumps credentials (e.g., using Mimikatz) and obtains a Domain Admin hash, they use PsExec (or heavily modified clones like Impacket's `psexec.py`) to "pass the hash." This allows them to instantly gain interactive command-line access to any server or workstation in the domain without cracking the actual password.
- Ransomware Deployment: Ransomware operators (such as Ryuk or Conti) frequently write scripts that loop through lists of all active IP addresses on the corporate network, utilizing PsExec to push the ransomware executable to every machine simultaneously, ensuring maximum destruction before defenders can react.
- Evasion: Because PsExec is a Microsoft-signed administrative tool, its execution is often ignored by legacy antivirus solutions, making it an ideal "fileless" execution vector.
Threat Assessment
The detection of PsExec execution is highly context-dependent. If it is used by a known administrator from a jump server to patch a system, it is benign. If it is executed from an unexpected endpoint (like a receptionist's PC) at 3:00 AM to launch a randomly named executable on a domain controller, it is a critical indicator of a major breach in progress.Incident Response and Remediation
- Behavioral Monitoring (EDR): Security teams must tune their EDR solutions to aggressively monitor the usage of PsExec. Alerts should trigger if PsExec is launched by non-administrative accounts, or if it is used to execute known malicious binaries, PowerShell scripts, or batch files.
- Network Segmentation (SMB): Limit lateral movement by heavily restricting SMB traffic (TCP Port 445) between workstations. Only allow designated administrative jump boxes to initiate SMB connections to endpoints.
- Credential Tiering: Implement the Microsoft Tiered Admin Model to prevent Domain Admin credentials from being cached on standard workstations, denying attackers the high-privileged accounts required to abuse PsExec across the enterprise.
Known aliases
Threat reports may refer to this family under multiple names:
MITRE ATT&CK Techniques
This family has been observed using the following ATT&CK techniques: T1569.002 T1021.002 T1570 T1543.003
Generated Detections (Boilerplate)
These YARA and Sigma rules are auto-generated based on the family name and aliases. They must be heavily tuned before deployment in a production environment.
YARA Rule
rule MALWARE_WIN_PSEXEC {
meta:
description = "Detects Psexec (ransomware)"
author = "SystemHelpdesk Boilerplate Generator"
date = "2026-07-06"
strings:
$s1 = "psexec" ascii wide nocase
$s2 = "hacktool.psexec" ascii wide nocase
$s3 = "sysinternals.psexec" ascii wide nocase
$s4 = "lateralmovement.tool" ascii wide nocase
condition:
uint16(0) == 0x5a4d and any of them
}Sigma Rule
title: Suspicious Psexec Activity
id: db719941e3f851036922cae2a74e8c3f
status: experimental
description: Detects generic indicators of the psexec malware family.
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith:
- '\cmd.exe'
- '\powershell.exe'
CommandLine|contains:
- "*psexec*"
- "*hacktool.psexec*"
- "*sysinternals.psexec*"
- "*lateralmovement.tool*"
condition: selection
level: mediumReferences & External Analysis
- Search "psexec" on VirusTotal (External Analysis)
Frequently Asked Questions
How do I remove the Psexec Ransomware from Windows?
Manual removal of Psexec is highly discouraged as it may leave persistence mechanisms intact. We recommend disconnecting the device from the internet and utilizing a professional incident response service or enterprise-grade EDR software to conduct a full forensic sweep.
Is Psexec a virus or a Ransomware?
Psexec is classified as a Ransomware. Unlike traditional viruses that infect files, modern malware like Psexec typically operates as a standalone payload designed to compromise systems, steal data, or deploy secondary stage implants.
What are the main symptoms of a Psexec infection?
Symptoms of Psexec can include unexpected system slowness, unauthorized outbound network traffic to unknown IP addresses, disabled security software, and suspicious background processes running from AppData or Temp directories.
Related Families (Category: ransomware)
Explore other malware families in the same category:
Protect Your Network Against Ransomwares
Want to prevent Psexec and similar threats from compromising your organization? Read our comprehensive defensive guide: Ransomware Protection Guide.
Machine-readable
Get this profile as JSON: https://jordan123234-malware-families-explorer.static.hf.space/api/psexec.json
Ecosystem & Interactive Environments
This profile is part of the Malware Families Catalog, a public dataset of 2,899 malware families. The catalog is also published across our ecosystem: Hugging Face, Kaggle, Zenodo, Replit, StackBlitz, CodeSandbox, and CodePen.