Winexe
MITRE ATT&CK: S0191 View on attack.mitre.org
Aliases: Winexe
- Related IoCs
- 2 (2 malicious)
- Last IoC activity
- 2026-10-14 06:38:38
- Profile updated
- 2026-07-07 12:43:23
Context
Winexe is a lightweight, open source tool similar to PsExec designed to allow system administrators to execute commands on remote servers. Winexe is unique in that it is a GNU/Linux based client.
Recent IoC activity
2 malicious indicators in Maltiverse are attributed to Winexe (S0191). The 2 most recently updated:
| Type | Indicator | Updated | Sources |
|---|---|---|---|
| file sample | winexesvc.exe | 2026-10-14 | 1 |
| file sample | 533048cc27b6a2fac79062a40b8645c0b2ef871703572efab84352f336768b2d | 2026-10-06 | 1 |
Detection coverage
- 39 Sigma rules
Malware & tools used
- Service Execution (attack-pattern)
Used by threat actors
- APT28 (threat-actor)
- DarkVishnya (threat-actor)
- Silence (threat-actor)
Reports & references
- netzpolitik.org — Digital Attack On German Parliament Investigative Report On The Hack Of The Left Party Infrastructure In Bundestag (report)
- MITRE ATT&CK — S0191 (report)
- github.com — Winexe (report)