Which SIEM platforms have a THREAT-LateralMovement-SMBPsExec detection rule?

df00tech provides THREAT-LateralMovement-SMBPsExec (Lateral Movement via SMB and PsExec-Style Remote Execution) detection queries for 7 SIEM platforms: Microsoft Sentinel / Defender, Splunk, Elastic Security (EQL), IBM QRadar (AQL), Sumo Logic CSE, Google Chronicle / SecOps, CrowdStrike LogScale (CQL).

What severity and confidence is the THREAT-LateralMovement-SMBPsExec detection?

The THREAT-LateralMovement-SMBPsExec detection is rated high severity with high confidence.

What are common false positives for THREAT-LateralMovement-SMBPsExec?

Common false positives for THREAT-LateralMovement-SMBPsExec include: Authorised IT administrators using PsExec from Sysinternals for remote administration from approved management workstations; Software deployment tools (SCCM, Ansible, Puppet) that use WMI or SMB for mass package deployment; Domain join and Group Policy application traffic over SMB (exclude SYSTEM and svchost.exe as initiators).

THREAT-LateralMovement-SMBPsExec

Lateral Movement via SMB and PsExec-Style Remote Execution

Q: What data sources are required to detect Lateral Movement via SMB and PsExec-Style Remote Execution (THREAT-LateralMovement-SMBPsExec)?

Detecting Lateral Movement via SMB and PsExec-Style Remote Execution requires the following data sources: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceServiceEvents, DeviceNetworkEvents), Sysmon Event ID 1, 3, 7, Windows Security Event Log.

Lateral Movement Execution Last updated: April 24, 2026

SMB-based lateral movement using PsExec, PAExec, or RemCom is the dominant lateral movement technique in ransomware deployments by Akira, Black Basta, and LockBit affiliates. The attacker gains initial credentials (via spray, phishing, or VPN compromise), then uses remote execution tools to install and run payloads on other hosts across the domain — typically targeting domain controllers first for maximum impact. Key behavioural indicators: (1) PsExec binary appearing in user temp directories rather than System32 (attackers drop it from a C2 payload); (2) PSEXESVC service being created on remote hosts — the server-side component of PsExec; (3) Admin share (ADMIN$) access used to copy the execution wrapper; (4) Use of Windows Management Instrumentation (WMI) or WinRM as alternatives when PsExec is blocked. NCSC has observed Akira affiliates using this exact pattern against UK SMBs since 2023.

What is THREAT-LateralMovement-SMBPsExec Lateral Movement via SMB and PsExec-Style Remote Execution?

Lateral Movement via SMB and PsExec-Style Remote Execution (THREAT-LateralMovement-SMBPsExec) maps to the Lateral Movement and Execution tactics — the adversary is trying to move through your environment in MITRE ATT&CK.

This page provides production-ready detection logic for Lateral Movement via SMB and PsExec-Style Remote Execution, covering the data sources and telemetry it touches: Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceServiceEvents, DeviceNetworkEvents), Sysmon Event ID 1, 3, 7, Windows Security Event Log. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic: Lateral Movement Execution

Microsoft Sentinel / Defender

kusto

// THREAT: Lateral Movement via SMB/PsExec-Style Remote Execution
// Detects PsExec, PAExec, PSEXESVC service creation, and Admin share lateral movement

// Alert 1: PsExec/PAExec execution from non-standard locations
let LegitPsExecPaths = dynamic(["C:\\Tools\\", "C:\\Sysinternals\\", "C:\\Program Files\\Sysinternals"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("psexec.exe", "psexec64.exe", "paexec.exe", "remcom.exe", "csexec.exe")
| where not(FolderPath has_any (LegitPsExecPaths))
| extend SuspiciousLocation = FolderPath has_any (
    "C:\\Users\\", "C:\\Windows\\Temp\\", "C:\\ProgramData\\",
    "AppData\\", "C:\\Temp\\", "C:\\Public\\"
  )
| project Timestamp, DeviceName, AccountName, FileName, FolderPath,
    ProcessCommandLine, InitiatingProcessFileName, SuspiciousLocation
| extend ThreatType = "LateralMovement_PsExec_SuspiciousPath"
| extend StagingRisk = 85;
// Alert 2: PSEXESVC service creation (server-side PsExec indicator)
DeviceServiceEvents
| where Timestamp > ago(24h)
| where ServiceName in~ ("PSEXESVC", "paexec", "remcom")
| project Timestamp, DeviceName, AccountName, ServiceName, ServiceState,
    InitiatingProcessFileName, InitiatingProcessCommandLine
| extend ThreatType = "LateralMovement_PSEXESVC_RemoteService"
| extend StagingRisk = 90;
// Alert 3: Admin share access from internal hosts (staging/lateral movement)
DeviceNetworkEvents
| where Timestamp > ago(24h)
| where RemotePort in (445, 139)
| where ActionType =~ "ConnectionSuccess"
| where RemoteIPType =~ "Private"
// Exclude expected domain controller replication and group policy traffic
| where InitiatingProcessFileName !in~ ("svchost.exe", "lsass.exe", "system")
| summarize
    Connections=count(),
    TargetHosts=dcount(RemoteIP),
    TargetIPs=make_set(RemoteIP)
  by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 15m)
| where Connections >= 5 or TargetHosts >= 3
| extend ThreatType = "LateralMovement_AdminShare_BulkAccess"
| extend StagingRisk = 75

Three-vector lateral movement detection: (1) PsExec/PAExec execution from temp/user directories rather than authorised management paths — attackers drop PsExec from their payload rather than using a pre-installed version; (2) PSEXESVC service creation on target hosts — the server-side PsExec indicator on the destination system; (3) bulk SMB connections to internal hosts from non-system processes — indicates automated scanning or lateral spread across network shares.

high severity high confidence

Data Sources

Microsoft Defender for Endpoint (DeviceProcessEvents, DeviceServiceEvents, DeviceNetworkEvents) Sysmon Event ID 1, 3, 7 Windows Security Event Log

Required Tables

DeviceProcessEvents DeviceServiceEvents DeviceNetworkEvents

False Positives

Authorised IT administrators using PsExec from Sysinternals for remote administration from approved management workstations
Software deployment tools (SCCM, Ansible, Puppet) that use WMI or SMB for mass package deployment
Domain join and Group Policy application traffic over SMB (exclude SYSTEM and svchost.exe as initiators)
Enterprise backup agents (Veeam, Backup Exec) that access admin shares during backup jobs

Elastic Security (EQL)

eql

sequence by host.name with maxspan=30m
  [process where event.type == "start" and
   process.name in~ ("psexec.exe", "psexec64.exe", "paexec.exe", "remcom.exe", "csexec.exe") and
   not process.executable like~ ("*\\Tools\\*", "*\\Sysinternals\\*", "*\\Program Files\\Sysinternals*")]
  [file where event.type == "creation" and
   file.name like~ "PSEXESVC.exe"]

// Alternatively, individual signal queries:
// Signal 1: PsExec from suspicious paths
process where event.type == "start" and
  process.name in~ ("psexec.exe", "psexec64.exe", "paexec.exe", "remcom.exe", "csexec.exe") and
  not process.executable like~ ("*\\Tools\\*", "*\\Sysinternals\\*", "*\\Program Files\\*") and
  process.executable like~ ("*\\Users\\*", "*\\Temp\\*", "*\\ProgramData\\*", "*\\AppData\\*", "*\\Public\\*")

// Signal 2: PSEXESVC service registration
process where event.type == "start" and process.name == "PSEXESVC.exe"

// Signal 3: Bulk SMB lateral movement
network where event.type == "connection" and
  destination.port in (445, 139) and
  network.direction == "outbound" and
  not process.name in~ ("svchost.exe", "lsass.exe", "System") and
  network.type == "ipv4"

Detects lateral movement via SMB/PsExec-style remote execution by monitoring for PsExec/PAExec/RemCom execution from non-standard paths, PSEXESVC service creation, and bulk SMB connections to internal hosts. Covers Akira, Black Basta, and LockBit ransomware affiliate TTPs.

critical severity high confidence

Data Sources

Windows Sysmon via Elastic Agent Elastic Endpoint Security Windows Security Event Logs

Required Tables

logs-endpoint.events.process-* logs-endpoint.events.network-* logs-endpoint.events.file-* logs-system.security-*

False Positives

Legitimate IT administrators running PsExec from a local downloads or desktop folder during ad-hoc remediation tasks
Automated patch management tools (e.g., SCCM, PDQ Deploy) that stage execution binaries in ProgramData before running them
Penetration test engagements where testers deliberately drop PsExec to workstations — should be excluded by source IP or user account

IBM QRadar (AQL)

sql

-- Signal 1: PsExec/PAExec from suspicious staging paths
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceHost,
  username AS AccountName,
  "Process Name" AS ProcessName,
  "Process Path" AS ProcessPath,
  QIDNAME(qid) AS EventName,
  logsourcename(logsourceid) AS LogSource,
  'LateralMovement_PsExec_SuspiciousPath' AS ThreatType,
  85 AS RiskScore
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (12, 14)  -- Sysmon / Windows Security
  AND (
    LOWER("Process Name") LIKE '%psexec.exe'
    OR LOWER("Process Name") LIKE '%psexec64.exe'
    OR LOWER("Process Name") LIKE '%paexec.exe'
    OR LOWER("Process Name") LIKE '%remcom.exe'
  )
  AND LOWER("Process Path") NOT LIKE '%\tools\%'
  AND LOWER("Process Path") NOT LIKE '%\sysinternals\%'
  AND LOWER("Process Path") NOT LIKE '%\program files\%'
  AND (
    LOWER("Process Path") LIKE '%\users\%'
    OR LOWER("Process Path") LIKE '%\temp\%'
    OR LOWER("Process Path") LIKE '%\programdata\%'
    OR LOWER("Process Path") LIKE '%\appdata\%'
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LAST 24 HOURS

UNION ALL

-- Signal 2: PSEXESVC service creation (Windows Event 7045)
SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  sourceip AS SourceHost,
  username AS AccountName,
  "Service Name" AS ProcessName,
  '' AS ProcessPath,
  QIDNAME(qid) AS EventName,
  logsourcename(logsourceid) AS LogSource,
  'LateralMovement_PSEXESVC_RemoteService' AS ThreatType,
  90 AS RiskScore
FROM events
WHERE
  EventID = 7045
  AND (
    LOWER("Service Name") = 'psexesvc'
    OR LOWER("Service Name") = 'paexec'
    OR LOWER("Service Name") = 'remcom'
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LAST 24 HOURS

QRadar AQL detection for SMB/PsExec lateral movement. Signal 1 identifies PsExec-family binaries executing from user writable staging paths. Signal 2 identifies PSEXESVC service creation (Event ID 7045) on the target host, the definitive server-side PsExec indicator.

critical severity high confidence

Data Sources

IBM QRadar SIEM Windows Security Event Logs (WinCollect) Sysmon log source via QRadar DSM

Required Tables

events

False Positives

IT helpdesk staff running PsExec from their user profile Downloads folder during support tasks — exclude by known admin source IPs or accounts
Legitimate PSEXESVC service creation during authorised remote administration by domain admins — whitelist by service account username
Security tooling that uses RemCom as an open-source PsExec alternative for legitimate remote execution in managed environments

Sumo Logic CSE

sql

// Signal 1: PsExec/PAExec from suspicious locations
_sourceCategory=*windows*sysmon* OR _sourceCategory=*wineventlog*
| where EventCode = "1" or EventCode = "4688"
| where (
    Image matches /(?i)(psexec\.exe|psexec64\.exe|paexec\.exe|remcom\.exe|csexec\.exe)$/
    or NewProcessName matches /(?i)(psexec\.exe|psexec64\.exe|paexec\.exe|remcom\.exe|csexec\.exe)$/
  )
| where !(
    Image matches /(?i)\\(tools|sysinternals|program files)/
    or NewProcessName matches /(?i)\\(tools|sysinternals|program files)/
  )
| where (
    Image matches /(?i)\\(users|temp|programdata|appdata|public)\\/
    or NewProcessName matches /(?i)\\(users|temp|programdata|appdata|public)\\/
  )
| parse field=Image "*\\*" as FolderPath, BinaryName nodrop
| parse field=NewProcessName "*\\*" as FolderPath2, BinaryName2 nodrop
| timeslice 15m
| count by _timeslice, Computer, User, Image, CommandLine
| where _count >= 1
| fields _timeslice, Computer, User, Image, CommandLine, _count
| eval ThreatType = "LateralMovement_PsExec_SuspiciousPath", RiskScore = 85
| sort - RiskScore

// Signal 2: PSEXESVC service creation
_sourceCategory=*wineventlog*system* OR _sourceCategory=*windows*sysmon*
| where EventCode = "7045" or EventCode = "4697"
| where ServiceName matches /(?i)(psexesvc|paexec|remcom)/
| timeslice 5m
| count by _timeslice, Computer, ServiceName, ServiceFileName, AccountName
| eval ThreatType = "LateralMovement_PSEXESVC_RemoteService", RiskScore = 90
| sort - RiskScore

// Signal 3: Bulk internal SMB connections
_sourceCategory=*windows*sysmon*
| where EventCode = "3"
| where DestinationPort = "445" or DestinationPort = "139"
| where !(
    Image matches /(?i)(svchost\.exe|lsass\.exe|system)/
  )
| timeslice 15m
| count as Connections, dcount(DestinationIp) as UniqueHosts by _timeslice, Computer, User, Image
| where Connections >= 5 or UniqueHosts >= 3
| eval ThreatType = "LateralMovement_AdminShare_BulkSMB", RiskScore = 75
| sort - RiskScore

Sumo Logic detection for SMB/PsExec-style lateral movement. Three correlated signals: suspicious-path PsExec execution (Sysmon Event 1 / Security 4688), PSEXESVC service creation (Event 7045/4697), and bulk internal SMB connection patterns (Sysmon Event 3). Targets Akira and Black Basta ransomware affiliate tradecraft.

critical severity high confidence

Data Sources

Sumo Logic Cloud SIEM Windows Sysmon (Sumo Logic collector) Windows Event Logs via Sumo Logic collector

Required Tables

_sourceCategory=*windows*sysmon* _sourceCategory=*wineventlog*

False Positives

System administrators downloading and running PsExec directly from their browser to %USERPROFILE%\Downloads before moving it to a proper tools directory
Automated RMM tools (ConnectWise, Kaseya) that create short-lived PSEXESVC service entries during remote command execution on managed endpoints
Domain group policy or login scripts that trigger multiple SMB connections at logon time, generating burst SMB traffic that exceeds the threshold

Google Chronicle / SecOps

yaral

rule threat_lateral_movement_smb_psexec {
  meta:
    name = "THREAT-LateralMovement-SMBPsExec"
    description = "Detects lateral movement via SMB and PsExec-style remote execution — PsExec/PAExec from non-standard paths, PSEXESVC service creation, and bulk Admin share access"
    author = "df00tech Detection Engineering"
    date = "2026-04-24"
    mitre_attack = "T1021.002, T1570, T1543.003"
    severity = "CRITICAL"
    confidence = "HIGH"
    reference = "https://www.ncsc.gov.uk/news/akira-ransomware"

  events:
    // Signal 1: PsExec/PAExec execution from user-writable staging path
    $proc.metadata.event_type = "PROCESS_LAUNCH"
    $proc.principal.hostname = $hostname
    $proc.target.process.file.full_path = /(?i)(psexec\.exe|psexec64\.exe|paexec\.exe|remcom\.exe|csexec\.exe)$/
    not $proc.target.process.file.full_path = /(?i)(\\tools\\|\\sysinternals\\|\\program files\\)/
    (
      $proc.target.process.file.full_path = /(?i)\\users\\/
      or $proc.target.process.file.full_path = /(?i)\\temp\\/
      or $proc.target.process.file.full_path = /(?i)\\programdata\\/
      or $proc.target.process.file.full_path = /(?i)\\appdata\\/
      or $proc.target.process.file.full_path = /(?i)\\public\\/
    )

  match:
    $hostname over 30m

  condition:
    $proc
}

rule threat_psexesvc_service_creation {
  meta:
    name = "THREAT-PSEXESVC-ServiceCreation"
    description = "Detects PSEXESVC service being installed on the target host — server-side PsExec indicator with highest fidelity for remote execution lateral movement"
    author = "df00tech Detection Engineering"
    date = "2026-04-24"
    mitre_attack = "T1021.002, T1543.003"
    severity = "CRITICAL"
    confidence = "HIGH"

  events:
    $svc.metadata.event_type = "SERVICE_CREATION"
    $svc.target.resource.name = /(?i)(psexesvc|paexec|remcom)/
    $svc.principal.hostname = $hostname

  match:
    $hostname over 5m

  condition:
    $svc
}

rule threat_bulk_smb_admin_share_access {
  meta:
    name = "THREAT-BulkSMB-AdminShare"
    description = "Detects bulk outbound SMB connections from a single host to multiple internal targets — characteristic of PsExec-based lateral movement scanning"
    author = "df00tech Detection Engineering"
    date = "2026-04-24"
    mitre_attack = "T1021.002"
    severity = "HIGH"
    confidence = "MEDIUM"

  events:
    $net.metadata.event_type = "NETWORK_CONNECTION"
    $net.network.application_protocol = "SMB"
    $net.principal.hostname = $src_host
    $net.target.ip = $dst_ip
    not $net.principal.process.file.full_path = /(?i)(svchost\.exe|lsass\.exe)/

  match:
    $src_host over 15m

  outcome:
    $unique_targets = count_distinct($dst_ip)

  condition:
    #net >= 5 and $unique_targets >= 3
}

Three Chronicle YARA-L 2.0 rules covering SMB/PsExec lateral movement: (1) PsExec-family execution from user-writable staging paths, (2) PSEXESVC service creation as high-fidelity remote execution indicator, (3) bulk Admin share access pattern detection. Mapped to T1021.002, T1570, T1543.003.

critical severity high confidence

Data Sources

Google Chronicle SIEM Windows Event Logs via Chronicle forwarder Microsoft Defender for Endpoint via Chronicle integration Windows Sysmon via Chronicle

Required Tables

UDM events: PROCESS_LAUNCH, SERVICE_CREATION, NETWORK_CONNECTION

False Positives

IT administrators intentionally running PsExec from non-standard paths during rapid incident response or emergency remote remediation tasks
Software deployment systems (SCCM, Intune) that temporarily install PSEXESVC during legitimate managed software push operations
Domain controllers generating high volumes of SMB connections during Group Policy processing, SYSVOL replication, or DFS namespace referrals

CrowdStrike LogScale (CQL)

cql

// Signal 1: PsExec/PAExec execution from suspicious staging paths
#event_simpleName = "ProcessRollup2"
| FileName = /(?i)^(psexec\.exe|psexec64\.exe|paexec\.exe|remcom\.exe|csexec\.exe)$/
| ImageFileName != /(?i)(\\tools\\|\\sysinternals\\|\\program files\\)/
| ImageFileName = /(?i)(\\users\\|\\windows\\temp\\|\\programdata\\|\\appdata\\|\\public\\)/
| groupBy([ComputerName, UserName, FileName, ImageFileName, CommandLine], function=[
    count(aid, as=EventCount),
    min(timestamp, as=FirstSeen),
    max(timestamp, as=LastSeen)
  ])
| eval ThreatType = "LateralMovement_PsExec_SuspiciousPath"
| eval RiskScore = 85
| sort(RiskScore, order=desc)

// Signal 2: PSEXESVC service creation
#event_simpleName = "ServiceInstalled"
| ServiceName = /(?i)^(psexesvc|paexec|remcom)$/
| groupBy([ComputerName, ServiceName, ServiceImagePath, UserName], function=[
    count(aid, as=Instances),
    min(timestamp, as=FirstSeen),
    max(timestamp, as=LastSeen)
  ])
| eval ThreatType = "LateralMovement_PSEXESVC_RemoteService"
| eval RiskScore = 90
| sort(RiskScore, order=desc)

// Signal 3: Bulk outbound SMB connections from single host
#event_simpleName = "NetworkConnectIP4"
| RemotePort in (445, 139)
| LocalAddressIP4 != RemoteAddressIP4
| ImageFileName != /(?i)(\\windows\\system32\\svchost\.exe|\\windows\\system32\\lsass\.exe)/
| RemoteAddressIP4 = /^(10\.|172\.(1[6-9]|2[0-9]|3[01])\.|192\.168\.)/
| groupBy([ComputerName, UserName, ImageFileName], function=[
    count(RemoteAddressIP4, as=Connections),
    countDistinct(RemoteAddressIP4, as=UniqueHosts),
    collect(RemoteAddressIP4, as=TargetIPs, limit=20)
  ])
| Connections >= 5 or UniqueHosts >= 3
| eval ThreatType = "LateralMovement_AdminShare_BulkSMB"
| eval RiskScore = 75
| sort(RiskScore, order=desc)

CrowdStrike LogScale (Falcon) detection for SMB/PsExec lateral movement. Uses Falcon telemetry event types ProcessRollup2, ServiceInstalled, and NetworkConnectIP4. Detects PsExec-family binaries from staging paths, PSEXESVC service creation, and bulk internal SMB connectivity patterns matching Akira/Black Basta ransomware affiliate techniques.

critical severity high confidence

Data Sources

CrowdStrike Falcon Platform Falcon Insight XDR (EDR telemetry) CrowdStrike LogScale SIEM

Required Tables

ProcessRollup2 ServiceInstalled NetworkConnectIP4

False Positives

Red team or purple team exercises where PsExec is deliberately staged in temp directories to simulate adversary tradecraft — should be excluded by sensor tag or host group
MSP remote management tooling that wraps PsExec or uses PSEXESVC internally for scripted patch deployment across customer endpoints
Vulnerability scanners or asset management platforms (Tenable, Qualys) that initiate authenticated SMB connections to multiple hosts in bulk during scheduled scan windows

Sigma rule & cross-platform mapping

The detection logic for Lateral Movement via SMB and PsExec-Style Remote Execution (THREAT-LateralMovement-SMBPsExec) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource:

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for THREAT-LateralMovement-SMBPsExec Sigma rules on detection.fyi

Platform-specific guides for THREAT-LateralMovement-SMBPsExec

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)

Last updated: 2026-04-24 Research depth: deep

References (4)

Testing Methodology

Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

Test 1PsExec Remote Command Execution for Lateral Movement Simulation
Expected signal: On source: Sysmon Event ID 1 for psexec.exe, Sysmon Event ID 3 for SMB connection to target. On target: Windows Event ID 7045 (PSEXESVC service installed), Sysmon Event ID 11 (PSEXESVC.exe created in C:\Windows\), Security Event ID 4624 (network logon).

Response Playbook

Triage

Identify the source host and account for PsExec execution. Is this a known IT management workstation? Is the account an IT admin account or a compromised user account?
If PSEXESVC service is created on a target host, trace back the source: which host initiated the connection? The source host and account combination is the attacker's pivot point.
Map lateral movement paths: which hosts were accessed? Is there a pattern (all domain controllers, all finance workstations, all file servers) that indicates the attacker's objective?
Check the PsExec command line: what was executed remotely? If it's the ransomware payload, encryption may already be in progress on the target hosts.
Determine the credential used: was it a domain admin, local admin, or service account? How was it obtained? This is critical for containment.

Containment

Isolate affected hosts via EDR host isolation immediately — do not rely on network-level isolation alone as the attacker may have multiple pivot points.
Disable the compromised account used for lateral movement.
Block SMB (port 445) between workstations at the internal firewall if host-to-host SMB is not required. Most ransomware lateral movement relies on workstation-to-workstation SMB.
Force domain admin session logoff from all workstations (there should be no domain admin sessions on non-server hosts).
Deploy emergency GPO to block PsExec execution via AppLocker or WDAC if not already in place: add PSEXESVC to application control blocklist.

Evidence Collection

Sysmon Event ID 1 for PsExec/PAExec processes with full command line
Sysmon Event ID 11 for PSEXESVC.exe file creation with source process
Windows Event ID 7045 (new service installed) for PSEXESVC service
Windows Security Event ID 4624 (logon) for network logons used during lateral movement
SMB access logs (Windows Event ID 5140) for Admin share access events

Escalation Criteria

! PSEXESVC created on a domain controller
! Ransomware payload executed via PsExec on multiple hosts
! Shadow copy deletion following PsExec lateral movement
! Domain admin account used for lateral movement (indicates full domain compromise)
! Lateral movement to backup servers or data repositories (pre-encryption exfiltration)

Investigation Guide

Forensic Artifacts

> PSEXESVC.exe in C:\Windows\: file creation time, hash, source of copy
> Windows Event ID 7045: new service installed — PSEXESVC service entry with start time
> SMB share access logs: Windows Security Event ID 5140/5145 showing Admin$ access
> Prefetch: PSEXESVC.EXE-*.pf and PSEXEC.EXE-*.pf on both source and target hosts
> Network captures: SMB traffic between source and target hosts during lateral movement

Tuning Guidance

The highest-fidelity signal in this detection is PSEXESVC service creation — this specific service name has no legitimate reason to appear unless PsExec is being used for remote execution. Create a zero-tolerance alert for PSEXESVC creation on servers and domain controllers. For workstations, add a whitelist of authorised IT admin source hosts from which PsExec use is expected. SMB connection monitoring generates more noise — use the 5-target threshold as a starting point and adjust based on your environment's normal file server access patterns.

Hunting Queries

Hunt for workstations with high numbers of outbound SMB connections to other internal hosts from non-system processes — indicates automated lateral movement or ransomware spreading via network shares.

Hunting — KQL

kql

DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 445
| where ActionType =~ "ConnectionSuccess"
| where InitiatingProcessFileName !in~ ("svchost.exe", "lsass.exe", "system", "ntoskrnl.exe")
| summarize
    TargetHosts=dcount(RemoteIP),
    Connections=count(),
    Targets=make_set(RemoteIP)
  by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where TargetHosts >= 5
| sort by TargetHosts desc

Hunting — SPL

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
  DestinationPort=445 NOT (Image="*svchost.exe" OR Image="*lsass.exe")
| bin _time span=1h
| stats dc(DestinationIp) AS TargetHosts, count AS Conns, values(DestinationIp) AS Targets
  BY host, User, Image
| where TargetHosts >= 5
| sort - TargetHosts

Atomic Red Team Tests

Test 1 PsExec Remote Command Execution for Lateral Movement Simulation

windows

Uses PsExec to execute a benign command on a remote host, simulating lateral movement. Tests detection of PSEXESVC service creation and remote execution via admin share.

Command

powershell

psexec.exe \\<TARGET_HOST> -u <DOMAIN>\<ADMIN_USER> -p <PASSWORD> -accepteula ipconfig /all

Expected Telemetry

On source: Sysmon Event ID 1 for psexec.exe, Sysmon Event ID 3 for SMB connection to target. On target: Windows Event ID 7045 (PSEXESVC service installed), Sysmon Event ID 11 (PSEXESVC.exe created in C:\Windows\), Security Event ID 4624 (network logon).

Expected Detection

Alert fires on PSEXESVC_Dropped indicator on target host (RiskScore=90) and PsExec_SuspiciousPath on source if dropped from non-standard path.

Related Detections

What is THREAT-LateralMovement-SMBPsExec Lateral Movement via SMB and PsExec-Style Remote Execution?

MITRE ATT&CK

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Sigma rule & cross-platform mapping

Platform-specific guides for THREAT-LateralMovement-SMBPsExec

Testing Methodology

Response Playbook

Triage

Containment

Evidence Collection

Escalation Criteria

Investigation Guide

Forensic Artifacts

Tuning Guidance

Hunting Queries

Atomic Red Team Tests

Command

Expected Telemetry

Expected Detection

Related Detections

Tactic Hubs

Parent Technique

Related Techniques

Same Tactic: Lateral Movement

Popular Detections

Get new detections in your inbox