PsExecTool
PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.From MITRE ATT&CK
Last reported 2 days ago, by Security Affairs45 reports
ATT&CK techniques
6 of 156 · each with the sentence it comes from- T1021.001Remote Desktop Protocol
“They also employ remote desktop protocol (RDP) to expand their presence within the compromised network.”
- T1110Brute Force
“…nitial access [TA0001] to organizations through various means, including credential exposure, implementing brute force password attacks [T1110], and exploiting virtual private network (VPN) access.” states the advisory.”
- T1036Masquerading
“A file used for potential masquerading or abuse of CCleaner components for execution or persistence.”
- T1053.005Scheduled Task
“In some cases, a scheduled task is used to run PowerShell:”
- T1059Command and Scripting Interpreter
“…] that creates an elevated process through a specified component object model, enabling the execution of malicious commands or binaries [T1059].”
- T1059.001PowerShell
“…nction used for enumerating network file shares in Windows Active Directory environments—to identify valuable assets for exfiltration [T1059.001, T1059.003].”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
45 reports · the newest 20, newest first · the exact sentence from each-
FBI and CISA Warn of SafePay Ransomware Attacks on 600 Organizations“They use PsExec, WinRM, RDP, and PowerShell to move between systems.”
-
The Science of Exploitability: Decoding BlueHammer“Subsequently, we authenticated the domain controller using the NTLM hash through PsExec.”
-
SafePay Has Compromised 600 Critical Infrastructure Victims Worldwide, CISA Warns“This approach involves using in-built administrative tools consistent with living off the land (LOTL) techniques, such as PsExec, WinRM and remote management and monitoring (RMM) software.”
-
#StopRansomware: SafePay Ransomware“Once SafePay threat actors establish a foothold in a victim’s network, they use LOTL binaries (LOLBins) [T1218], such as PsExec [T1021.002] and Windows Remote Management (WinRM) [T1021.006], to execute commands on remote systems.”
-
Phishing Abuses RMM Tools for Persistent Access“Block process creations originating from PsExec and WMI commands.”
-
RansomHub ransomware-as-a-service“…Protocol (T1021.001), SMB/Windows Admin Shares (T1021.002) using unpatched smbexec, along with other tools from Impacket collection, and PsExec from Microsoft SysInternals.”
-
Deciphering the Brain Cipher Ransomware“…t Detection and Response (EDR) solution to detect and respond to suspicious activities, such as deploying backdoors and using tools like PsExec.”
-
Qilin Revisited: Diving into the techniques and procedures of the recent Qilin Ransomware Attacks“It achieves this through an embedded version of Sysinternals PsExec (version 2.43) stored within the ransomware’s code.”
-
Patch or Peril: A Veeam vulnerability incident“Shortly thereafter, LB3.exe (EstateRansomware) and PsExec utility was dropped into the “C:\PerfLogs” folder.”
-
Ransomware manager: Investigation into farnetwork, a threat actor linked to five strains of ransomware“…s requested a ransom of $200,000 in Bitcoin The same report also revealed that Nokoyawa operators used IcedID malware and tools such as PsExec, AdFind, and Cobalt Strike.”
-
REvil Twins: Ransomware-as-a-Service program“Usually the threat actors try to deploy ransomware as widely as possible, and use PsExec or Group Policy modification to run a scheduled task to run it.”
-
BlackCat Ransomware: Tactics, Techniques & Mitigation Strategies“…ther modifying group policies (which results in a scheduled task being created, on each host, that launches the malicious file) or using PsExec.”
-
Connecting the Bots“Like many others, the threat actors usually leveraged PsExec for deployment.”
-
The Locking Egregor“In some cases, the threat actors also distributed Qakbot through the network via PsExec, just like in cases with Prolock we observed in the past, they use a file named “md.exe” – that is the Qakbot binary.”
-
Big Game Hunting: Now in Russia“OldGremlin deployed TinyCryptor with PsExec module of Cobalt Strike.”
-
Lock Like a Pro“For example, they used PsExec to manually distribute Qakbot throughout the company.”
-
ATT&CKing ProLock Ransomware“For remote script execution, ProLock operators use PsExec from Sysinternals Suite, another common tool.”
-
Hunting for Attacker’s Tactics and Techniques With Prefetch Files“Let’s keep going and look at one of the most typical examples of lateral movement (TA0008) – PsExec, which interacts with the ADMIN$ network share (Windows Admin Shares, T1077).”
-
Secrets of Cobalt“Remote access via RDP and using PsExec is typical for network administrators.”
-
Petya starts with Ukraine and then goes global“…strator’s password on the computer where it first entered, and tries to connect to all computers on the network, using a legitimate tool PsExec, Wmi and exploits from the NSA set.”
Indicators in its reports
named in the reports above- exploit[.]inin 2 reports
Copy this indicator · defanged
Thanks — we review every report.