Remote command executed from a Linux host

BIOC Low

Remote command executed from a Linux host

This tool enables commands to be remotely executed on a Microsoft Windows computer from a Linux computer. This capability is leveraged by attackers to run code remotely, similarly to PsExec.

Module:: Platform Analytics
Agent event type:: Process execution
Category:: Lateral Movement
Status:: Enabled

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: System Services: Service Execution (T1569.002)

Indicator:

Process action type = execution AND target process name = winexesvc.exe , winexe.exe

Preventable: yes