S0029: PsExec
Analyst context for executives and security teams
PsExec matters because it is a legitimate Microsoft Windows administration tool that can run programs on another computer, but ATT&CK also documents its use by many campaigns and groups. For leaders, the risk is not the tool by itself; it is whether the organization can distinguish approved remote administration from attacker-driven execution using valid privileges.
Executive priority
Treat PsExec as a governance and visibility issue for Windows administration. Security leaders should ask: where is PsExec approved, which privileged accounts may use it, how is remote execution reviewed, and can the SOC reconstruct who ran what on which system? The relationship context spans espionage, financially motivated, critical infrastructure, and destructive campaign descriptions, so control decisions should prioritize environments where remote execution could affect business continuity, regulated data, or cyber-physical operations.
Technical view
ATT&CK lists PsExec as a Windows tool with no tactic or detection text provided. SOC and IR teams should therefore validate local coverage rather than assume ATT&CK supplies a detection pattern. Focus on approved-versus-unapproved execution of PsExec-like remote administration activity, privileged account usage, execution on remote Windows hosts, and lateral movement context when correlated with the related campaigns and groups that ATT&CK says used this object. Because PsExec is dual-use, detections need allowlisting, change-ticket context, administrator baselines, and escalation paths for unexpected use on sensitive systems.
Likely telemetry
- Windows endpoint process execution telemetry on source and destination systems
- Privileged account authentication and authorization events
- Remote administration activity between Windows hosts
- Administrative tool inventory or software execution records
- Centralized logging from endpoints, identity systems, and security monitoring tools
Detection direction
- Build detections around deviations from approved PsExec use rather than tool presence alone.
- Correlate remote execution with privileged account activity, unusual source/destination pairs, sensitive servers, and lack of a corresponding change record.
- Tune carefully for IT administrator activity to reduce false positives while preserving alerting for use outside approved admin groups or maintenance windows.
- Use the ATT&CK relationship context to prioritize monitoring in sectors or environments similar to those described in related campaigns, including financial institutions, energy, government, managed service providers, and critical infrastructure where applicable.
- Document coverage gaps explicitly because the ATT&CK object provides no official detection guidance and no tactic mapping in the supplied fields.
Mitigation priorities
- Define an approved-use policy for PsExec and comparable Windows remote administration tools.
- Limit use to authorized administrators and managed systems; review privileged account exposure regularly.
- Maintain an inventory of where the tool is present or permitted and remove unnecessary copies or unmanaged usage paths.
- Require centralized logging for remote administration and privileged execution before relying on detections.
- Use change management and incident response playbooks to distinguish legitimate administration from suspicious activity quickly.
Analyst notes and limits
The object is especially material because it is a legitimate Microsoft tool, not malware, and ATT&CK relationships show broad historical use across many campaigns and groups. That makes context, identity, and operational baselining more important than simple tool-blocking decisions.
The supplied ATT&CK fields do not include official detection logic, tactic mappings, aliases, or detailed procedure examples. Local telemetry, administrative workflows, and risk appetite are required to determine whether PsExec use is normal, suspicious, or prohibited in a given environment.
PsExec
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1021.002 | SMB/Windows Admin Shares Sub-technique | PsExec, a tool that has been used by adversaries, writes programs to the |
| Enterprise | T1543.003 | Windows Service Sub-technique | PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the |
| Enterprise | T1570 | Lateral Tool Transfer | PsExec can be used to download or upload a file over a network share.CitationPsExec Russinovich |
| Enterprise | T1569.002 | Service Execution Sub-technique | Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service.CitationRussinovich Sysinternals |
| Enterprise | T1136.002 | Domain Account Sub-technique | PsExec has the ability to remotely create accounts on target systems.CitationNCC Group Fivehands June 2021 |
Groups, software, and campaigns
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
G0010: Turla
Turla is a cyber espionage threat group that has been attributed to Russia's Federal Security Service (FSB). They have compromised victims in over 50 countries since at least 2004, spanning a range of industries including government, embassies, military, education, research and pharmaceutical companies. Turla is known for conducting watering hole and spearphishing campaigns, and leveraging in-house tools and malware, such as Uroburos.[1][2][3][4][5]
G0114: Chimera
G0006: APT1
G0076: Thrip
G1009: Moses Staff
Moses Staff is a suspected Iranian threat group that has primarily targeted Israeli companies since at least September 2021. Moses Staff openly stated their motivation in attacking Israeli companies is to cause damage by leaking stolen sensitive data and encrypting the victim's networks without a ransom demand.[1]
Security researchers assess Moses Staff is politically motivated, and has targeted government, finance, travel, energy, manufacturing, and utility companies outside of Israel as well, including those in Italy, India, Germany, Chile, Turkey, the UAE, and the US.[2]
G0098: BlackTech
BlackTech is a suspected Chinese cyber espionage group that has primarily targeted organizations in East Asia--particularly Taiwan, Japan, and Hong Kong--and the US since at least 2013. BlackTech has used a combination of custom malware, dual-use tools, and living off the land tactics to compromise media, construction, engineering, electronics, and financial company networks.[1][2][3]
G0003: Cleaver
G0105: DarkVishnya
DarkVishnya is a financially motivated threat actor targeting financial institutions in Eastern Europe. In 2017-2018 the group attacked at least 8 banks in this region.[1]
G1032: INC Ransom
INC Ransom is a ransomware and data extortion threat group associated with the deployment of INC Ransomware that has been active since at least July 2023. INC Ransom has targeted organizations worldwide most commonly in the industrial, healthcare, and education sectors in the US and Europe.[1][2][3][4]
G0034: Sandworm Team
Sandworm Team is a destructive threat group that has been attributed to Russia's General Staff Main Intelligence Directorate (GRU) Main Center for Special Technologies (GTsST) military unit 74455.[1][2] This group has been active since at least 2009.[3][4][5][6]
In October 2020, the US indicted six GRU Unit 74455 officers associated with Sandworm Team for the following cyber operations: the 2015 and 2016 attacks against Ukrainian electrical companies and government organizations, the 2017 worldwide NotPetya attack, targeting of the 2017 French presidential campaign, the 2018 Olympic Destroyer attack against the Winter Olympic Games, the 2018 operation against the Organisation for the Prohibition of Chemical Weapons, and attacks against the country of Georgia in 2018 and 2019.[1][2] Some of these were conducted with the assistance of GRU Unit 26165, which is also referred to as APT28.[7]
G1046: Storm-1811
Storm-1811 is a financially-motivated entity linked to Black Basta ransomware deployment. Storm-1811 is notable for unique phishing and social engineering mechanisms for initial access, such as overloading victim email inboxes with non-malicious spam to prompt a fake "help desk" interaction leading to the deployment of adversary tools and capabilities.[1][2][3][4]
C0058: SharePoint ToolShell Exploitation
The SharePoint ToolShell Exploitation campaign was conducted in July 2025 and encompassed the first waves of exploitation against incompletely patched spoofing (CVE-2025-49706) and remote code execution (CVE-2025-49704) vulnerabilities affecting on-premises Microsoft SharePoint servers. Later patched and updated as CVE-2025-53770 and CVE-2025-53771, the ToolShell vulnerabilities were widely exploited including by China-based ransomware actor Storm-2603 and espionage actors Threat Group-3390 and ZIRCONIUM. SharePoint ToolShell Exploitation targeted multiple regions and industries including finance, education, energy, and healthcare across Asia, Europe, and the United States.[1][2][3][4][5]
C0063: 2025 Poland Wiper Attacks
2025 Poland Wiper Attacks is a Russian state-sponsored campaign that conducted destructive cyberattacks against Polish energy infrastructure in December 2025. Targets included more than 30 wind and photovoltaic farms, a combined heat and power (CHP) plant, and a manufacturing sector company. The attacks on the distributed energy resources (DER) disrupted communications between affected facilities and the distribution system operator, but did not impact electricity generation or heat supply. Across the campaign, threat actors deployed two previously undocumented wiper tools, DynoWiper, a Windows-based wiper and LazyWiper, a PowerShell wiper, distributed via malicious Group Policy Objects. At the CHP plant, threat actors had maintained access since at least March 2025, using that foothold to obtain credentials and move laterally before attempting wiper deployment. Some reporting has assessed the activity to be consistent with Russian Federal Security Service (FSB) threat activity group Dragonfly, also tracked as STATIC TUNDRA, while other reporting attributes the destructive wiper activities to the Russian General Staff Main Intelligence Directorate (GRU) threat activity group ELECTRUM, also tracked as Sandworm Team.[1][2][3][4]
C0004: CostaRicto
CostaRicto was a suspected hacker-for-hire cyber espionage campaign that targeted multiple industries worldwide, with a large number being financial institutions. CostaRicto actors targeted organizations in Europe, the Americas, Asia, Australia, and Africa, with a large concentration in South Asia (especially India, Bangladesh, and Singapore), using custom malware, open source tools, and a complex network of proxies and SSH tunnels.[1]
C0002: Night Dragon
Night Dragon was a cyber espionage campaign that targeted oil, energy, and petrochemical companies, along with individuals and executives in Kazakhstan, Taiwan, Greece, and the United States. The unidentified threat actors searched for information related to oil and gas field production systems, financials, and collected data from SCADA systems. Based on the observed techniques, tools, and network activities, security researchers assessed the campaign involved a threat group based in China.[1]
C0014: Operation Wocao
Operation Wocao was a cyber espionage campaign that targeted organizations around the world, including in Brazil, China, France, Germany, Italy, Mexico, Portugal, Spain, the United Kingdom, and the United States. The suspected China-based actors compromised government organizations and managed service providers, as well as aviation, construction, energy, finance, health care, insurance, offshore engineering, software development, and transportation companies.[1]
Security researchers assessed the Operation Wocao actors used similar TTPs and tools as APT20, suggesting a possible overlap. Operation Wocao was named after an observed command line entry by one of the threat actors, possibly out of frustration from losing webshell access.[1]
C0023: Operation Ghost
Operation Ghost was an APT29 campaign starting in 2013 that included operations against ministries of foreign affairs in Europe and the Washington, D.C. embassy of a European Union country. During Operation Ghost, APT29 used new families of malware and leveraged web services, steganography, and unique C2 infrastructure for each victim.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.7 | Current bundle | 33ae638757e8… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Russinovich Sysinternals
Russinovich, M. (2014, May 2). Windows Sysinternals PsExec v2.11. Retrieved May 13, 2015.
Open source URL -
[2]
SANS PsExec
Pilkington, M. (2012, December 17). Protecting Privileged Domain Accounts: PsExec Deep-Dive. Retrieved August 17, 2016.
Open source URL -
[3]
mitre-attack S0029Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.