PsExec is a command-line tool from Microsoft’s Sysinternals suite that lets an administrator run programs on remote Windows systems. It is legitimate and widely used for administration and troubleshooting. It is also a favourite of attackers, because it is trusted, signed and looks like routine work.

What is PsExec used for?

Administrators use it to run commands or scripts on remote machines without logging in to them, to open a remote command prompt and to run programs with elevated rights. It is simple, fast and requires no software to be installed in advance.

How does PsExec work?

1. It connects to the remote machine over SMB, the Windows file-sharing protocol.
2. It copies a small service executable to the administrative share.
3. It starts that service on the remote machine, with a name such as PSEXESVC.
4. It runs the requested command and sends the output back through a named pipe.
5. It removes the service when the command finishes.

It requires an account with administrator rights on the target machine.

Is PsExec malware?

No. It is a legitimate tool. Security products usually do not block it, which is exactly why attackers use it. The same file can be an administrator’s convenience or an attacker’s way to move through the network.

Why do attackers use PsExec?

• It is signed by Microsoft and often already present in the environment.
• It provides remote execution with administrator rights.
• It leaves little that looks like malware.
• It lets them run commands on many machines at speed.
• It has been used to launch ransomware across many systems.

How is it used in lateral movement?

An attacker with administrator credentials, or a stolen hash, runs PsExec against another machine to execute commands there, then repeats the process to reach more systems. It turns one compromised account into movement across the network.

Why is it hard to detect?

The tool is legitimate and the connection uses valid credentials. Whether the use is normal depends on who ran it, from which machine and against which targets, not on the tool itself.

What are the signs of PsExec abuse?

• A service named PSEXESVC created on a machine.
• Access to the ADMIN$ share followed by service creation.
• PsExec run by accounts that are not administrators.
• Many remote executions from one machine in a short time.
• Use outside normal administration hours.

What does PsExec abuse look like in practice?

A phished employee’s machine is used to find an administrator’s credentials. The attacker runs PsExec from that machine against a file server, then against an application server, then against a backup system. Each step is a valid administrator action, and each is a few minutes after the last.

What does living off the land mean?

Attackers use tools that are already present and trusted, such as PsExec or built-in scripting, instead of bringing their own malware. This avoids detection by tools that look for malicious files, and it makes behaviour the main signal.

What are the alternatives to PsExec?

PowerShell remoting, Windows Remote Management and other remote administration tools do similar things, and attackers use them too. Blocking one tool does not remove the technique.

Can you simply block PsExec?

It helps, but it is not a complete answer, because the same result can be reached with other tools. The more lasting protection is to limit who has administrator rights, where those accounts can sign in and to watch how they are used.

How do you reduce the risk?

• Restrict who has administrator rights, and where those accounts can sign in.
• Block SMB traffic between workstations.
• Use application control to limit which administrative tools can run.
• Prefer approved remote management methods and log them.
• Grant administrative access only when needed, and for a limited time.

Sharelock monitors identity behaviour across systems, so a valid administrator account that suddenly runs remote executions it has never run before, or from an unusual machine, stands out against its normal pattern.

‍