{
  "family": "psexec",
  "sample_count": 1,
  "category": "ransomware",
  "description": "<h3>Executive Summary</h3>\nPsExec is a perfectly legitimate, highly powerful command-line utility created by Microsoft Sysinternals. It allows system administrators to execute processes on remote Windows systems without having to manually install client software. However, due to its immense power and \"living off the land\" nature, PsExec is one of the most heavily abused tools by threat actors, ransomware gangs, and APT groups to facilitate rapid lateral movement and automated payload deployment across compromised networks.\n\n<h3>Technical Capabilities and Malicious Abuse</h3>\nPsExec operates using the Server Message Block (SMB) protocol. It connects to the hidden `ADMIN$` share on the target machine, uploads a lightweight service executable (`PSEXESVC.exe`), and starts it via the Windows Service Control Manager (SCM). This service then executes the requested command.\n\nThreat actors exploit this functionality after they have compromised an administrative account:\n<ul>\n<li><strong>Lateral Movement:</strong> Once an attacker dumps credentials (e.g., using Mimikatz) and obtains a Domain Admin hash, they use PsExec (or heavily modified clones like Impacket's `psexec.py`) to \"pass the hash.\" This allows them to instantly gain interactive command-line access to any server or workstation in the domain without cracking the actual password.</li>\n<li><strong>Ransomware Deployment:</strong> Ransomware operators (such as Ryuk or Conti) frequently write scripts that loop through lists of all active IP addresses on the corporate network, utilizing PsExec to push the ransomware executable to every machine simultaneously, ensuring maximum destruction before defenders can react.</li>\n<li><strong>Evasion:</strong> Because PsExec is a Microsoft-signed administrative tool, its execution is often ignored by legacy antivirus solutions, making it an ideal \"fileless\" execution vector.</li>\n</ul>\n\n<h3>Threat Assessment</h3>\nThe detection of PsExec execution is highly context-dependent. If it is used by a known administrator from a jump server to patch a system, it is benign. If it is executed from an unexpected endpoint (like a receptionist's PC) at 3:00 AM to launch a randomly named executable on a domain controller, it is a critical indicator of a major breach in progress.\n\n<h3>Incident Response and Remediation</h3>\n<ul>\n<li><strong>Behavioral Monitoring (EDR):</strong> Security teams must tune their EDR solutions to aggressively monitor the usage of PsExec. Alerts should trigger if PsExec is launched by non-administrative accounts, or if it is used to execute known malicious binaries, PowerShell scripts, or batch files.</li>\n<li><strong>Network Segmentation (SMB):</strong> Limit lateral movement by heavily restricting SMB traffic (TCP Port 445) between workstations. Only allow designated administrative jump boxes to initiate SMB connections to endpoints.</li>\n<li><strong>Credential Tiering:</strong> Implement the Microsoft Tiered Admin Model to prevent Domain Admin credentials from being cached on standard workstations, denying attackers the high-privileged accounts required to abuse PsExec across the enterprise.</li>\n</ul>",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [
    "HackTool.PsExec",
    "Sysinternals.PsExec",
    "LateralMovement.Tool"
  ],
  "enrichment_level": "expert-seo",
  "faq": [
    {
      "@type": "Question",
      "name": "What is Psexec and what threat category does it belong to?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Psexec is classified as a Ransomware. Documented across security telemetry, it is engineered to execute unauthorized operations, establish persistent footholds on target endpoints, and facilitate malicious campaigns targeting enterprise and individual environments."
      }
    },
    {
      "@type": "Question",
      "name": "How does Psexec establish persistence and evade defensive controls?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Psexec typically establishes persistence through registry run keys, scheduled tasks, or service installations, while evading signature-based antivirus solutions through code obfuscation, memory injection, or anti-analysis sandbox checks."
      }
    },
    {
      "@type": "Question",
      "name": "What are the essential incident response steps for mitigating a Psexec compromise?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Security teams responding to Psexec should immediately isolate affected endpoints from the network, perform memory triage to capture volatile forensic artifacts, audit registry and startup persistence mechanisms, revoke exposed user credentials, and restore systems from verified, clean backups."
      }
    },
    {
      "@type": "Question",
      "name": "What cryptographic algorithms and file targeting techniques does HackTool.PsExec employ during execution?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "HackTool.PsExec typically leverages hybrid cryptographic architectures combining symmetric stream or block ciphers (such as AES-256 or ChaCha20) for rapid file encryption with asymmetric algorithms (such as RSA-2048 or Curve25519) to securely protect the session keys. It aggressively targets sensitive file extensions including corporate documents, databases, virtual disks, and backups while systematically executing commands to delete Volume Shadow Copies (vssadmin delete shadows /all /quiet) and disable system recovery options."
      }
    },
    {
      "@type": "Question",
      "name": "Are decryptors available for HackTool.PsExec, and what is the recommended recovery procedure?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Decryption availability for HackTool.PsExec depends on whether security researchers or law enforcement (such as the No More Ransom initiative) have recovered the master private keys or discovered flaws in its key generation routines. Victims should never pay the extortion demand, as payment fuels criminal operations without guaranteeing file restoration. The recommended recovery procedure entails isolating infected hosts, conducting forensic disk imaging, identifying the root access vector, and restoring validated systems from immutable offline backups."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1569.002",
    "T1021.002",
    "T1570",
    "T1543.003"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "type": "HackTool (Dual-Use)",
  "target_industries": [
    "Healthcare",
    "Critical Infrastructure",
    "Enterprise"
  ],
  "motivation": "Financial Extortion",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ],
  "attack_stage": [
    "defense_evasion",
    "impact"
  ],
  "ecosystem": [
    "windows_pe"
  ],
  "is_emerging": false,
  "mitre_attack_detail": [
    {
      "id": "T1569.002",
      "name": "System Services: Service Execution",
      "tactic": "Execution"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1570",
      "name": "Lateral Tool Transfer",
      "tactic": "lateral-movement"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Immediately isolate affected host(s) from the internal network (disconnect physical Ethernet and disable Wi-Fi/Bluetooth) to prevent Psexec from spreading laterally or encrypting network-attached storage (NAS) and shared SMB volumes.",
    "Preserve volatile system memory (RAM capture) on a representative endpoint before attempting a reboot or power-down, as Psexec symmetric encryption keys or uncompiled payload components may still reside in memory.",
    "Audit process execution logs and terminate active scripting interpreters (e.g. PowerShell, CMD, WScript) or commands executing 'vssadmin.exe delete shadows' or 'wbadmin' used by Psexec to inhibit recovery.",
    "Investigate the initial compromise vector (such as exposed RDP instances, spearphishing attachments, or vulnerable edge gateways) and enforce an immediate credential reset for all compromised Active Directory accounts.",
    "Restore critical assets and databases exclusively from verified, air-gapped, or immutable offline backups once the Psexec binary and related persistence hooks are eradicated."
  ],
  "what_to_avoid": [
    "Do not restart or power cycle infected systems prematurely; doing so destroys volatile RAM encryption keys and may trigger bootloader locking logic embedded in Psexec.",
    "Avoid negotiating or paying the extortion demand without prior forensic evaluation and consultation with incident response specialists, as payment does not guarantee data recovery.",
    "Do not connect clean backup drives or external storage to the affected network until Psexec eradication is completely verified."
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows Server 2022",
    "Windows Server 2019"
  ]
}