tool

Winexe S0191

Type: tool
Created: 18 April 2018
Last modified: 4 September 2024

Winexe is a lightweight, open source tool similar to PsExec designed to allow system administrators to execute commands on remote servers. [1] Winexe is unique in that it is a GNU/Linux based client. [2]

TechniqueBottom 5%

TacticBottom 6%

Threat groupsunranked

CampaignsNone recorded

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0191

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Standing S0191

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	d7a95147-145f-4678-b85d-d1ff4a3bb3f6
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevat (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Wojciech Lesicki	2021-05-26	2022-11-27	5a105d34-05fc-401e-8553-272b45c1522d
	Detects the installation of a service named "javamtsup" on the system. (...)	Emerging	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-10-09	cb062102-587e-4414-8efa-dbe3c7bf19c6
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog Security	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	f0d1feba-4344-4ca9-8121-a6c97bd6df52
	Detects well-known credential dumping tools execution via service execution events	Generic	test	service	windows	WinEventLog System	Credential Access OS Credential Dumping LSASS Memory Security Account Manager LSA Secrets Cached Domain Credentials Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Teymur Kheirkhabarov, Daniil Yugoslavskiy, oscd.community	2017-03-05	2022-11-29	4976aa50-8f41-45c6-8b15-ab3fc10e79ed
	Detects default CSExec service filename which indicates CSExec service installation and execution	Generic	test	file_event	windows	Sysmon	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-04	—	f0e2b768-5220-47dd-b891-d57b96fc0ec1
	Detects CSExec service installation and execution events	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-07	—	a27e5fa9-c35e-4e3d-b7e0-1ce2af66ad12
	Identifies clients that may be performing DNS lookups associated with common currency mining pools.	Generic	test	-	-	DNS · Zeek	Impact Resource Hijacking Execution System Services Service Execution	-	low	Saw Winn Naung, Azure-Sentinel, @neu5ron	2021-08-19	2022-07-07	bf74135c-18e8-4a72-a926-0e4f47888c19
	Detects exploitation of DNS RCE bug reported in CVE-2020-1350 by the detection of suspicious sub pro (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Exploit Public-Facing Application Execution System Services Service Execution	CVE-2020-1350	critical	Florian Roth (Nextron Systems)	2020-07-15	2022-07-12	b5281f31-f9cc-4d0d-95d0-45b91c45b487
Splunk	The following analytic detects excessive usage of the `sc.exe` service utility on a host machine. (...)	Anomaly	stable	process_creation	windows	Sysmon	Execution System Services Service Execution	-	medium	Teoderick Contreras, Splunk	2021-06-24	2026-05-13	cb6b339e-d4c6-11eb-a026-acde48001122
Splunk	The following analytic detects the first occurrence of a Windows service running in your environment. (...)	Anomaly	experimental	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	David Dorsey, Splunk	2019-10-16	2026-05-13	823136f2-d755-4b6d-ae04-372b486a5808	-
	Detects the use of SharpUp, a tool for local privilege escalation	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Group Policy Discovery Execution, Stealth Hijack Execution Flow Executable Installer File Permissions Weakness Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems)	2022-08-20	2023-02-13	c484e533-ee16-4a93-b6ac-f0ea4868b2f1
	Detects installation or execution of services	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems)	2022-03-21	2023-08-07	d26ce60c-2151-403c-9a42-49420d87b5e4
Splunk	The following analytic detects the suspicious service started. (...)	Anomaly	stable	process_creation	linux	Linux Auditd	Execution System Services Service Execution	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	b5eed06d-5c97-4092-a3a1-fa4b7e77c71a
Splunk	The following analytic identifies the execution of malicious PowerShell commands or payloads via the Windows SC.exe utility. (...)	Generic	stable	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Ryan Becwar	2021-04-13	2026-05-13	8e204dfd-cae0-4ea8-a61d-e972a1ff2ff8
	Detects known malicious service installs that only appear in cases of lateral movement, credential dumping, and other suspicious activities.	Unsupported	unsupported	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Credential Access OS Credential Dumping Execution System Services Service Execution	-	critical	Florian Roth (Nextron Systems), Daniil Yugoslavskiy, oscd.community (update)	2017-03-27	2022-03-21	2cfe636e-317a-4bee-9f2c-1066d9f54d1a
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Unsupported	unsupported	service	windows	WinEventLog System	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-03-21	1a17ce75-ff0d-4f02-9709-2b7bb5618cf0
	Detects usage of Metasploit SMB PsExec (exploit/windows/smb/psexec) and Impacket psexec.py by trigge (...)	Generic	test	service	windows	WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-21	2022-10-05	6fb63b40-e02a-403e-9ffd-3bcc1d749442
	Windows DCE-RPC functions which indicate an execution techniques on the remote system. (...)	Generic	test	-	-	DCE/RPC · Zeek	Execution, Persistence, Privilege Escalation Scheduled Task/Job At Execution System Services Service Execution Execution Windows Management Instrumentation	-	medium	@neu5ron, SOC Prime	2020-03-19	2021-11-27	b640c0b8-87f8-4daa-aef8-95a24261dd1d
	Detects PAExec service installation	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-26	—	de7ce410-b3fb-4e8a-b38c-3b999e2c3420
	Detects known malicious service installs that appear in cases in which a Cobalt Strike beacon elevates privileges or lateral movement.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Wojciech Lesicki	2021-06-29	2024-03-25	61a7697c-cb79-42a8-a2ff-5f0cdfae0130
	Detects suspicious remote procedure call (RPC) service anomalies based on the spawned sub processes (...)	Emerging	test	process_creation	windows	Sysmon · WinEventLog Security	Initial Access Exploit Public-Facing Application Execution System Services Service Execution	CVE-2022-26809	high	Florian Roth (Nextron Systems)	2022-04-13	2023-02-03	a7cd7306-df8b-4398-b711-6f3e4935cf16
	Detects that a powershell code is written to the registry as a service.	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Execution System Services Service Execution	-	high	oscd.community, Natalia Shornikova	2020-10-06	2023-08-17	4a5f5a5e-ac01-474b-9b4e-d61298c9df1d
	Detects powershell script installed as a Service	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	high	oscd.community, Natalia Shornikova	2020-10-06	2022-12-25	a2e5019d-a658-4c6a-92bf-7197b54e2cae
	Detects powershell script installed as a Service	Generic	test	service	windows	WinEventLog Security	Execution System Services Service Execution	-	high	oscd.community, Natalia Shornikova	2020-10-06	2022-11-29	2a926e6a-4b81-4011-8a96-e36cc8c04302
	Detects a ProcessHacker tool that elevated privileges to a very high level	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems)	2021-05-27	2022-12-25	c4ff1eac-84ad-44dd-a6fb-d56a92fc43a9
	Detects blocking of process creations originating from PSExec and WMI commands	Generic	test	-	windows	Windows Defender	Execution System Services Service Execution Execution Windows Management Instrumentation	-	high	Bhabesh Raj	2020-07-14	2022-12-25	97b9ce1e-c5ab-11ea-87d0-0242ac130003
	Detects PsExec service default pipe creation	Hunting	test	pipe_created	windows	Sysmon	Execution System Services Service Execution	-	low	Thomas Patzke	2017-06-12	2022-10-09	f3f3a972-f982-40ad-b63c-bca6afdfad7c
	Detects default PsExec service filename which indicates PsExec service installation and execution	Generic	test	file_event	windows	Sysmon	Execution System Services Service Execution	-	low	Thomas Patzke	2017-06-12	2022-10-26	259e5a6a-b8d2-4c38-86e2-26c5e651361d
	Detects PsExec service installation and execution events	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Thomas Patzke	2017-06-12	2023-08-04	42c575ea-e41e-41f1-b248-8093c3e82a28
	Detects PsExec default pipe creation where the image executed is located in a suspicious location. (...)	Generic	test	pipe_created	windows	Sysmon	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-08-04	2023-09-20	41504465-5e3a-4a5b-a5b4-2a0baadd4463
	Detects default CSExec pipe creation	Generic	test	pipe_created	windows	Sysmon	Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	medium	Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-08-07	2023-11-30	f318b911-ea88-43f4-9281-0de23ede628e
	Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Resource Development Develop Capabilities Malware Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems)	2022-08-22	2023-02-21	d08a2711-ee8b-4323-bdec-b7d85e892b31
	Detects the use of NirCmd tool for command execution, which could be the result of legitimate admini (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution System Services Service Execution	-	medium	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-24	2023-02-13	4e2ed651-1906-4a59-a78a-18220fca1b22
	Detects the use of NirCmd tool for command execution as SYSTEM user	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-01-24	2023-02-13	d9047477-0359-48c9-b8c7-792cedcdc9c4
	Detects the use of NSudo tool for command execution	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali	2022-01-24	2023-02-13	771d1eb5-9587-4568-95fb-9ec44153a012
	Detects PAExec default named pipe	Generic	test	pipe_created	windows	Sysmon	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-10-26	—	f6451de4-df0a-41fa-8d72-b39f54a08db5
	Detects default RemCom pipe creation	Generic	test	pipe_created	windows	Sysmon	Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	medium	Nikita Nazarov, oscd.community, Nasreddine Bencherchali (Nextron Systems)	2023-08-07	2023-11-30	d36f87ea-c403-44d2-aa79-1a0ac7c24456
	Detects the use of the RunXCmd tool to execute commands with System or TrustedInstaller accounts	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems)	2022-01-24	2023-02-14	93199800-b52a-4dec-b762-75212c196542
	Detects default RemCom service filename which indicates RemCom service installation and execution	Generic	test	file_event	windows	Sysmon	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-04	—	7eff1a7f-dd45-4c20-877a-f21e342a7611
	Detects RemCom service installation and execution events	Generic	test	service	windows	WinEventLog System	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-08-07	—	9e36ed87-4986-482e-8e3b-5c23ffff11bf
	Detects service installation of different remote access tools software. (...)	Generic	test	service	windows	WinEventLog Security	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	medium	Connor Martin, Nasreddine Bencherchali (Nextron Systems)	2022-12-23	2024-12-07	c8b00925-926c-47e3-beea-298fd563728e
	Detects service installation of different remote access tools software. (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	medium	Connor Martin, Nasreddine Bencherchali	2022-12-23	2023-06-22	1a31b18a-f00c-4061-9900-f735b96c99fc
	Detects remote RPC calls to possibly abuse remote encryption service via MS-EFSR	Generic	test	-	-	RPC Firewall	Execution System Services Service Execution	-	high	Sagie Dulce, Dekel Paz	2022-01-01	—	10018e73-06ec-46ec-8107-9172f1e04ff2
	Detects rundll32 execution without parameters as observed when running Metasploit windows/smb/psexec (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Lateral Movement Lateral Tool Transfer Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Bartlomiej Czyz, Relativity	2021-01-31	2023-02-28	5bb68627-3198-40ca-b458-49f973db8752
	Detects known malicious service installation that appear in cases in which a Sliver implants execute (...)	Generic	test	service	windows	WinEventLog System	Persistence, Privilege Escalation Create or Modify System Process Windows Service Execution System Services Service Execution	-	high	Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)	2022-08-25	—	31c51af6-e7aa-4da7-84d4-8f32cc580af2
	Detects the use of smbexec.py tool by detecting a specific service installation	Generic	test	service	windows	WinEventLog System	Lateral Movement Remote Services SMB/Windows Admin Shares Execution System Services Service Execution	-	high	Omer Faruk Celik	2018-03-20	2023-11-09	52a85084-6989-40c3-8f32-091e12e13f09
	Detects the usage of the "net.exe" command to start a service using the "start" flag	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Execution System Services Service Execution	-	low	Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community	2019-10-21	2023-03-05	2a072a96-a086-49fa-bcb5-15cc5a619093
	Detects registry modifications that add Windows Filtering Platform (WFP) filters, which may be used to block security tools and EDR agents from reporting events.	Generic	experimental	registry_set	windows	Sysmon · WinEventLog Security	Defense Impairment Disable or Modify Tools Execution System Services Service Execution	-	medium	Frack113	2025-10-23	—	1f1d8209-636e-4c6c-a137-781cca8b82f9
Splunk	The following analytic detects changes in the ScManager service security descriptor settings. (...)	Generic	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Execution System Services Service Execution	-	medium	Nasreddine Bencherchali, Michael Haag, Splunk	2024-12-06	2026-10-02	04023928-0381-4935-82cb-03372b2ef644

Title

Description

Winexe S0191

Winexe S0191

Winexe MITRE reference S0191

Standing S0191

Reach

Coverage

Winexe MITRE reference S0191

Standing S0191

Reach

Coverage

Winexe detections S0191