PsExec

Operating systems

windows

Related IoCs

16 (5 malicious)

Last IoC activity

2026-10-17 10:08:49

Profile updated

2026-07-07 15:32:29

Context

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.

Recent IoC activity

5 malicious indicators in Maltiverse are attributed to PsExec (S0029). The 5 most recently updated:

Detection coverage

• 120 Sigma rules

Malware & tools used

• SMB/Windows Admin Shares (attack-pattern)
• Windows Service (attack-pattern)
• Lateral Tool Transfer (attack-pattern)
• Service Execution (attack-pattern)
• Domain Account (attack-pattern)

Used by threat actors

• SharePoint ToolShell Exploitation (campaign)
• 2025 Poland Wiper Attacks (campaign)
• CostaRicto (campaign)
• Night Dragon (campaign)
• Operation Wocao (campaign)
• Operation Ghost (campaign)
• Quantum Ransomware Compromise (campaign)
• Threat Group-1314 (threat-actor)
• Cobalt Group (threat-actor)
• Wizard Spider (threat-actor)
• Ember Bear (threat-actor)
• Moses Staff (threat-actor)
• Sandworm Team (threat-actor)
• Magic Hound (threat-actor)
• Medusa Group (threat-actor)
• Fox Kitten (threat-actor)
• Volt Typhoon (threat-actor)
• Indrik Spider (threat-actor)
• INC Ransom (threat-actor)
• The Gentlemen (threat-actor)
• Storm-1811 (threat-actor)
• TEMP.Veles (threat-actor)
• APT1 (threat-actor)
• Turla (threat-actor)
• Cleaver (threat-actor)

Reports & references

• MITRE ATT&CK — S0029 (report)
• Microsoft — Bb897553 (report)
• sans.org — Protecting Privileged Domain Accounts Psexec Deep Dive (report)

External references

• mitre-attack — S0029
• SANS PsExec
• Russinovich Sysinternals
• misp-galaxy
• misp-galaxy
• misp-galaxy