PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.
| Technique | Procedure example |
|---|---|
| T1021.002 SMB/Windows Admin Shares |
PsExec, a tool that has been used by adversaries, writes programs to the |
| T1136.002 Domain Account |
PsExec has the ability to remotely create accounts on target systems. |
| T1543.003 Windows Service |
PsExec can leverage Windows services to escalate privileges from administrator to SYSTEM with the |
| T1569.002 Service Execution |
Microsoft Sysinternals PsExec is a popular administration tool that can be used to execute binaries on remote systems using a temporary Windows service. |
| T1570 Lateral Tool Transfer |
PsExec can be used to download or upload a file over a network share. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
