BIOC
Informational
✕
PsExec attempts to execute a command on a remote host
PsExec is a SysInternals tool used to execute commands on remote hosts.
- Module:
- Platform Analytics
- Agent event type:
- Network
- Category:
- Lateral Movement
- Status:
- Enabled
ATT&CK tactics: Lateral Movement (TA0008) Execution (TA0002)
ATT&CK techniques: Remote Services: SMB/Windows Admin Shares (T1021.002) System Services: Service Execution (T1569.002)
Indicator:
Network action type = outgoing , failed AND remote port = 135 , 445 Process initiated by = psexec.exe AND initiator signature = Signed AND initiator signer = Microsoft Corporation Host host os = windows
Preventable: yes