PsExec S0029

Type: tool
Platform: Windows
Created: 31 May 2017
Last modified: 12 May 2026

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.[1][2]

TechniquesBottom 23%

Tactics32nd pct

Threat groupsunranked

Campaignsunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

PsExec MITRE reference S0029

SMB/Windows Admin Shares T1021.002 ↗

PsExec, a tool that has been used by adversaries, writes programs to the ADMIN$ network share to execute commands on remote systems.3

Lateral Movement54 detection rules

Domain Account T1136.002 ↗

PsExec has the ability to remotely create accounts on target systems.4

Persistence11 detection rules

Windows Service T1543.003 ↗

PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the -s argument.5

Persistence · Privilege Escalation72 detection rules

Service Execution T1569.002 ↗

Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.6

Execution55 detection rules

Lateral Tool Transfer T1570 ↗

PsExec can be used to download or upload a file over a network share.7

Lateral Movement7 detection rules

Standing S0029

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Reach

Techniques5Bottom 23%

23rd percentile · 77% of 825 ATT&CK software entries have more Enterprise techniques.

Tactics432nd pct

32nd percentile · 68% of 825 ATT&CK software entries have more tactics spanned.

Threat groups3861% tie · 22 values

61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.

Campaigns685% tie · 8 values

85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.

Coverage

Rules / technique54medTop 6%

94th percentile · 94% of 825 ATT&CK software entries have this many detection rules per technique or fewer.

Tests / technique5med

PsExec detections S0029

173 distinct rules cover the 5 techniques recorded for this tool. 127 Sigma · 46 Splunk.

5 covered by at least one rule173 distinct rules in total

Showing 1-50 of 100+ rules

Drag headers to reorder | Drag edges to resize

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects access to ADMIN$ network share	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	low	Florian Roth (Nextron Systems)	2017-03-04	2024-01-16	098d7118-55bc-4912-a836-dc6483a8d150
	Detects the creation of a machine account whose name starts with 'GHOST', which is the naming conven (...)	Emerging	experimental	account_management	windows	WinEventLog Security	Persistence Create Account Domain Account Credential Access Steal or Forge Authentication Certificates	CVE-2026-54121	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-07-30	—	fa0bac5f-d170-4a91-9780-1ad71dc1f49e
	Detects suspicious DACL modifications to allow access to a service from a suspicious trustee. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-02-28	2025-10-22	6c8fbee5-dee8-49bc-851d-c3142d02aa47
	This method detects malicious services mentioned in APT29 report by FireEye. (...)	Unsupported	unsupported	process_creation	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Thomas Patzke	2017-11-01	2022-03-21	c069f460-2b87-4010-8dcf-e45bab362624
	Detects automated lateral movement by Turla group	Unsupported	unsupported	process_creation	windows	Sysmon · WinEventLog Security	Execution Command and Scripting Interpreter Discovery File and Directory Discovery Discovery Network Share Discovery Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Markus Neis	2017-11-07	2023-02-24	75925535-ca97-4e0a-a850-00b5c00779dc
Splunk	The following analytic identifies the use of named-pipe impersonation for privilege escalation, commonly associated with Cobalt Strike and similar frameworks. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution Command and Scripting Interpreter Windows Command Shell Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Michael Haag, Splunk	2021-05-27	2026-05-13	eb277ba0-b96b-11eb-b00e-acde48001122
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects a copy command or a copy utility execution to or from an Admin share or remote	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Collection Data from Network Shared Drive Exfiltration Exfiltration Over Alternative Protocol Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Florian Roth (Nextron Systems), oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, Nasreddine Bencherchali	2019-12-30	2025-10-22	855bc8b5-2ae8-402e-a9ed-b889e6df1900
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	f0d1feba-4344-4ca9-8121-a6c97bd6df52
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog System	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	4976aa50-8f41-45c6-8b15-ab3fc10e79ed
	Detects default CSExec service filename which indicates CSExec service installation and execution	Generic	test	file_event	windows	Sysmon	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-04	—	f0e2b768-5220-47dd-b891-d57b96fc0ec1
	Detects CSExec service installation and execution events	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-07	—	a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12
	Detects the use of the spoolss named pipe over SMB. (...)	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	OTR (Open Threat Research)	2018-11-28	2022-08-11	214e8f95-100a-4e04-bb31-ef6cba8ce07e
	Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model	-	high	Roberto Rodriguez @Cyb3rWard0g, Open Threat Research (OTR)	2020-10-12	2022-11-26	c39f0c81-7348-4965-ab27-2fde35a1b641
	Detects suspicious DACL modifications to deny access to a service that affects critical trustees. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Jonhnathan Ribeiro, oscd.community	2020-10-16	2023-02-28	99cf1e02-00fb-4c0d-8375-563f978dfd37
Splunk	The following analytic identifies the execution of `PsExec.exe` with the `accepteula` flag in the command line. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Bhavin Patel, Splunk	2020-04-29	2026-10-09	27c3a83d-cada-47c6-9042-67baf19d2574
	Detects execution of devcon.exe with commands that disable the VMware Virtual Machine Communication Interface (VMCI) device. (...)	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Defense Impairment Disable or Modify Tools	-	high	Matt Anderson, Dray Agha, Anna Pham (Huntress)	2026-01-02	—	85f520e7-6f5e-43ca-874c-222e5bf9c0de
	Identifies clients that may be performing DNS lookups associated with common currency mining pools.	Generic	test	-	-	DNS · Zeek	Impact Resource Hijacking Execution System Services Service Execution	-	low	Saw Winn Naung, Azure-Sentinel, @neu5ron	2021-08-19	2022-07-07	bf74135c-18e8-4a72-a926-0e4f47888c19
	Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub pro (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Exploit Public-Facing Application Execution System Services Service Execution	CVE-2020-1350	critical	Florian Roth (Nextron Systems)	2020-07-15	2022-07-12	b5281f31-f9cc-4d0d-95d0-45b91c45b487
	Detects a driver load from a temporary directory	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	high	Florian Roth (Nextron Systems)	2017-02-12	2021-11-27	2c4523d5-d481-4ed0-8ec3-7fbf0cb41a75
Splunk	The following analytic detects excessive usage of the `sc.exe` service utility on a host machine. (...)	Anomaly	stable	process_creation	windows	Sysmon	Execution System Services Service Execution	-	medium	Teoderick Contreras, Splunk	2021-06-24	2026-05-13	cb6b339e-d4c6-11eb-a026-acde48001122
Splunk	The following analytic detects executable files (.exe, .dll, etc.) being written to Windows administrative SMB shares (Admin$, IPC$, C$). (...)	Generic	stable	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Teoderick Contreras, Mauricio Velazco, Splunk	2021-04-26	2026-08-05	f63c34fe-a435-11eb-935a-acde48001122
	Detects repeated failed (outgoing) attempts to mount a hidden share	Unsupported	unsupported	-	windows	SMB Client	Lateral Movement Remote Services SMB/Windows Admin Shares	-	medium	Fabian Franz	2022-08-30	2023-02-24	1c3be8c5-6171-41d3-b792-cab6f717fcdb
	This detection excludes known namped pipes accessible remotely and notify on newly observed ones, ma (...)	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Samir Bousseaden	2019-04-03	2023-03-14	52d8b0c6-53d6-439a-9e41-52ad442ad9ad
	This detection excludes known namped pipes accessible remotely and notify on newly observed ones, ma (...)	Generic	test	-	-	SMB · Zeek	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Samir Bousseaden, @neu5ron, Tim Shelton	2020-04-02	2022-12-27	021310d9-30a6-480a-84b7-eaa69aeb92bb
Splunk	The following analytic detects the first occurrence of a Windows service running in your environment. (...)	Anomaly	experimental	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	David Dorsey, Splunk	2019-10-16	2026-05-13	823136f2-d755-4b6d-ae04-372b486a5808	-
	Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. (...)	Generic	experimental	file_event	windows	Sysmon	Execution Command and Scripting Interpreter Visual Basic Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Swachchhanda Shrawan Poudel (Nextron Systems)	2026-04-08	—	efc21479-9e83-41da-8cf1-122e06ba8db3
	Detects the execution of SharpMove, a .NET utility performing multiple tasks such as "Task Creation", "SCM" query, VBScript execution using WMI via its PE metadata and command line options.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Luca Di Bartolomeo (CrimpSec)	2024-01-29	—	055fb54c-a8f4-4aee-bd44-f74cf30a0d9d
	Detects the use of SharpUp, a tool for local privilege escalation	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Group Policy Discovery Execution, Stealth Hijack Execution Flow Executable Installer File Permissions Weakness Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems)	2022-08-20	2023-02-13	c484e533-ee16-4a93-b6ac-f0ea4868b2f1
	Detects installation or execution of services	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems)	2022-03-21	2023-08-07	d26ce60c-2151-403c-9a42-49420d87b5e4
Splunk	The following analytic identifies the use of suspicious command-line parameters associated with Impacket tools, such as `wmiexec.py`, `smbexec.py`, `dcomexec.py`, and `atexec.py`, which are used for lateral movement and remote code execution. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Mauricio Velazco, Splunk	2021-11-19	2026-05-13	8ce07472-496f-11ec-ab3b-3e22fbd008af
Splunk	The following analytic identifies suspicious command-line parameters associated with the use of Impacket's smbexec.py for lateral movement. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2023-04-25	2026-05-13	bb3c1bac-6bdf-4aa0-8dc9-068b8b712a76
Splunk	The following analytic detects the use of Impacket's `wmiexec.py` tool for lateral movement by identifying specific command-line parameters. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Distributed Component Object Model Execution Windows Management Instrumentation	-	medium	Michael Haag, Splunk	2021-11-19	2026-10-09	d6e464e4-5c6a-474e-82d2-aed616a3a492
	Detects execution of Impacket's psexec.py.	Generic	test	network_connection	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Bhabesh Raj	2020-12-14	2022-09-22	32d56ea1-417f-44ff-822b-882873f5f43b
Splunk	The following analytic detects the suspicious service started. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Execution System Services Service Execution	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	b5eed06d-5c97-4092-a3a1-fa4b7e77c71a
	Detects loading of known malicious drivers via their hash.	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service Privilege Escalation Exploitation for Privilege Escalation	-	high	Nasreddine Bencherchali (Nextron Systems)	2022-08-18	2023-12-02	05296024-fe8a-4baf-8f3d-9a5f5624ceb2
	Detects loading of known malicious drivers via the file name of the drivers.	Generic	test	driver_load	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service Privilege Escalation Exploitation for Privilege Escalation	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-03	2023-12-02	39b64854-5497-4b57-a448-40977b8c9679
Splunk	The following analytic identifies the execution of malicious PowerShell commands or payloads via the Windows SC.exe utility. (...)	Generic	stable	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Ryan Becwar	2021-04-13	2026-05-13	8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
	Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.	Unsupported	unsupported	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Credential Access OS Credential Dumping Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-03-21	2cfe636e-317a-4bee-9f2c-1066d9f54d1a
	Adversaries may create a domain account to maintain access to victim systems. (...)	Generic	test	ps_script	windows	PowerShell	Persistence Create Account Domain Account	-	medium	frack113	2021-12-28	—	b29a93fb-087c-4b5b-a84d-ee3309e69d08
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Unsupported	unsupported	service	windows	WinEventLog System	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-03-21	1a17ce75-ff0d-4f02-9709-2b7bb5618cf0
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Generic	test	service	windows	WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-10-05	6fb63b40-e02a-403e-9ffd-3bcc1d749442
	Alerts on Metasploit host's authentications on the domain.	Generic	test	authentication	windows	WinEventLog Security	Lateral Movement Remote Services SMB/Windows Admin Shares	-	high	Chakib Gzenayi (@Chak092), Hosni Mribah	2020-05-06	2024-01-25	72124974-a68b-4366-b990-d30e0b2a190d
	Windows DCE-RPC functions which indicate an execution techniques on the remote system. (...)	Generic	test	-	-	DCE/RPC · Zeek	Execution, Persistence, Privilege Escalation Scheduled Task/Job At Execution System Services Service Execution Execution Windows Management Instrumentation	-	medium	@neu5ron, SOC Prime	2020-03-19	2021-11-27	b640c0b8-87f8-4daa-aef8-95a24261dd1d
	Detects the use of Moriya rootkit as described in the securelist's Operation TunnelSnake report	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	critical	Bhabesh Raj	2021-05-06	2022-11-29	25b9c01c-350d-4b95-bed1-836d04a4f324
	Detects the creation of a file named "MoriyaStreamWatchmen.sys" in a specific location. (...)	Emerging	test	file_event	windows	Sysmon	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	critical	Bhabesh Raj	2021-05-06	2023-05-05	a1507d71-0b60-44f6-b17c-bf53220fdd88
	Detects execution of "Net.EXE".	Hunting	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Account Discovery Local Account Domain Account Discovery Network Share Discovery Discovery Password Policy Discovery Discovery Permission Groups Discovery Local Groups Domain Groups Lateral Movement Remote Services SMB/Windows Admin Shares Discovery Remote System Discovery Discovery System Network Connections Discovery Discovery System Service Discovery	-	low	Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)	2019-01-16	2022-07-11	183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
	Detects creation of a new service (kernel driver) with the type "kernel"	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-07-14	2025-10-07	431a1fdb-4799-4f3b-91c3-a683b003fc49