Windows PsExec Execution Triggered by psexec.exe Process Creation
Flags process creation of PsExec (psexec.exe / psexec.c), a tool often used for remote execution and potential lateral movement.
- Product
- windows
- Category
- process_creation
- Author
- omkar72 (SigmaHQ), DRL 1.1
- Published
- 2020-10-30
- Updated
- 2026-07-30
ATT&CK techniques
Execution → Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches Windows process creation events where the executable path ends with \psexec.exe or the original file name is psexec.c. PsExec is commonly used to remotely start processes over Windows networks, so its execution can indicate lateral movement or remote administration activity by an attacker. The detection relies on process creation telemetry, including the process image path and the OriginalFileName field.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows PsExec Execution Triggered by psexec.exe Process Creation
id: fec4a04a-5406-495b-b965-b287630d770b
status: test
description: This rule matches Windows process creation events where the executable path ends with \psexec.exe or the original file name is psexec.c. PsExec is commonly used to remotely start processes over Windows networks, so its execution can indicate lateral movement or remote administration activity by an attacker. The detection relies on process creation telemetry, including the process image path and the OriginalFileName field.
references:
- https://www.fireeye.com/blog/threat-research/2020/10/kegtap-and-singlemalt-with-a-ransomware-chaser.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_sysinternals_psexec_execution.yml
author: omkar72, Huntrule Team
date: 2020-10-30
modified: 2023-02-28
tags:
- attack.execution
- attack.lateral-movement
- attack.t1569
- attack.t1021
logsource:
category: process_creation
product: windows
detection:
selection:
- Image|endswith: \psexec.exe
- OriginalFileName: psexec.c
condition: selection
falsepositives:
- Administrative scripts.
level: medium
license: DRL-1.1
related:
- id: 730fc21b-eaff-474b-ad23-90fd265d4988
type: derived