Detect Lateral Movement via SMB and PsExec-Style Remote Execution in IBM QRadar
SMB-based lateral movement using PsExec, PAExec, or RemCom is the dominant lateral movement technique in ransomware deployments by Akira, Black Basta, and LockBit affiliates. The attacker gains initial credentials (via spray, phishing, or VPN compromise), then uses remote execution tools to install and run payloads on other hosts across the domain — typically targeting domain controllers first for maximum impact. Key behavioural indicators: (1) PsExec binary appearing in user temp directories rather than System32 (attackers drop it from a C2 payload); (2) PSEXESVC service being created on remote hosts — the server-side component of PsExec; (3) Admin share (ADMIN$) access used to copy the execution wrapper; (4) Use of Windows Management Instrumentation (WMI) or WinRM as alternatives when PsExec is blocked. NCSC has observed Akira affiliates using this exact pattern against UK SMBs since 2023.
MITRE ATT&CK
- Tactic
- Lateral Movement Execution
QRadar Detection Query
-- Signal 1: PsExec/PAExec from suspicious staging paths
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
sourceip AS SourceHost,
username AS AccountName,
"Process Name" AS ProcessName,
"Process Path" AS ProcessPath,
QIDNAME(qid) AS EventName,
logsourcename(logsourceid) AS LogSource,
'LateralMovement_PsExec_SuspiciousPath' AS ThreatType,
85 AS RiskScore
FROM events
WHERE
LOGSOURCETYPEID(logsourceid) IN (12, 14) -- Sysmon / Windows Security
AND (
LOWER("Process Name") LIKE '%psexec.exe'
OR LOWER("Process Name") LIKE '%psexec64.exe'
OR LOWER("Process Name") LIKE '%paexec.exe'
OR LOWER("Process Name") LIKE '%remcom.exe'
)
AND LOWER("Process Path") NOT LIKE '%\tools\%'
AND LOWER("Process Path") NOT LIKE '%\sysinternals\%'
AND LOWER("Process Path") NOT LIKE '%\program files\%'
AND (
LOWER("Process Path") LIKE '%\users\%'
OR LOWER("Process Path") LIKE '%\temp\%'
OR LOWER("Process Path") LIKE '%\programdata\%'
OR LOWER("Process Path") LIKE '%\appdata\%'
)
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LAST 24 HOURS
UNION ALL
-- Signal 2: PSEXESVC service creation (Windows Event 7045)
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
sourceip AS SourceHost,
username AS AccountName,
"Service Name" AS ProcessName,
'' AS ProcessPath,
QIDNAME(qid) AS EventName,
logsourcename(logsourceid) AS LogSource,
'LateralMovement_PSEXESVC_RemoteService' AS ThreatType,
90 AS RiskScore
FROM events
WHERE
EventID = 7045
AND (
LOWER("Service Name") = 'psexesvc'
OR LOWER("Service Name") = 'paexec'
OR LOWER("Service Name") = 'remcom'
)
AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LAST 24 HOURSQRadar AQL detection for SMB/PsExec lateral movement. Signal 1 identifies PsExec-family binaries executing from user writable staging paths. Signal 2 identifies PSEXESVC service creation (Event ID 7045) on the target host, the definitive server-side PsExec indicator.
Data Sources
Required Tables
False Positives & Tuning
- IT helpdesk staff running PsExec from their user profile Downloads folder during support tasks — exclude by known admin source IPs or accounts
- Legitimate PSEXESVC service creation during authorised remote administration by domain admins — whitelist by service account username
- Security tooling that uses RemCom as an open-source PsExec alternative for legitimate remote execution in managed environments
Other platforms for THREAT-LateralMovement-SMBPsExec
Testing Methodology
Validate this detection against 1 adversary technique from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1 PsExec Remote Command Execution for Lateral Movement Simulation
Expected signal: On source: Sysmon Event ID 1 for psexec.exe, Sysmon Event ID 3 for SMB connection to target. On target: Windows Event ID 7045 (PSEXESVC service installed), Sysmon Event ID 11 (PSEXESVC.exe created in C:\Windows\), Security Event ID 4624 (network logon).
Response Playbook
Triage
- Identify the source host and account for PsExec execution. Is this a known IT management workstation? Is the account an IT admin account or a compromised user account?
- If PSEXESVC service is created on a target host, trace back the source: which host initiated the connection? The source host and account combination is the attacker's pivot point.
- Map lateral movement paths: which hosts were accessed? Is there a pattern (all domain controllers, all finance workstations, all file servers) that indicates the attacker's objective?
- Check the PsExec command line: what was executed remotely? If it's the ransomware payload, encryption may already be in progress on the target hosts.
- Determine the credential used: was it a domain admin, local admin, or service account? How was it obtained? This is critical for containment.
Containment
- Isolate affected hosts via EDR host isolation immediately — do not rely on network-level isolation alone as the attacker may have multiple pivot points.
- Disable the compromised account used for lateral movement.
- Block SMB (port 445) between workstations at the internal firewall if host-to-host SMB is not required. Most ransomware lateral movement relies on workstation-to-workstation SMB.
- Force domain admin session logoff from all workstations (there should be no domain admin sessions on non-server hosts).
- Deploy emergency GPO to block PsExec execution via AppLocker or WDAC if not already in place: add PSEXESVC to application control blocklist.
Evidence Collection
- Sysmon Event ID 1 for PsExec/PAExec processes with full command line
- Sysmon Event ID 11 for PSEXESVC.exe file creation with source process
- Windows Event ID 7045 (new service installed) for PSEXESVC service
- Windows Security Event ID 4624 (logon) for network logons used during lateral movement
- SMB access logs (Windows Event ID 5140) for Admin share access events
Escalation Criteria
- !PSEXESVC created on a domain controller
- !Ransomware payload executed via PsExec on multiple hosts
- !Shadow copy deletion following PsExec lateral movement
- !Domain admin account used for lateral movement (indicates full domain compromise)
- !Lateral movement to backup servers or data repositories (pre-encryption exfiltration)
Investigation Guide
Related Techniques
Forensic Artifacts
- >
PSEXESVC.exe in C:\Windows\: file creation time, hash, source of copy - >
Windows Event ID 7045: new service installed — PSEXESVC service entry with start time - >
SMB share access logs: Windows Security Event ID 5140/5145 showing Admin$ access - >
Prefetch: PSEXESVC.EXE-*.pf and PSEXEC.EXE-*.pf on both source and target hosts - >
Network captures: SMB traffic between source and target hosts during lateral movement
Tuning Guidance
The highest-fidelity signal in this detection is PSEXESVC service creation — this specific service name has no legitimate reason to appear unless PsExec is being used for remote execution. Create a zero-tolerance alert for PSEXESVC creation on servers and domain controllers. For workstations, add a whitelist of authorised IT admin source hosts from which PsExec use is expected. SMB connection monitoring generates more noise — use the 5-target threshold as a starting point and adjust based on your environment's normal file server access patterns.
Hunting Queries
Hunt for workstations with high numbers of outbound SMB connections to other internal hosts from non-system processes — indicates automated lateral movement or ransomware spreading via network shares.
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemotePort == 445
| where ActionType =~ "ConnectionSuccess"
| where InitiatingProcessFileName !in~ ("svchost.exe", "lsass.exe", "system", "ntoskrnl.exe")
| summarize
TargetHosts=dcount(RemoteIP),
Connections=count(),
Targets=make_set(RemoteIP)
by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 1h)
| where TargetHosts >= 5
| sort by TargetHosts descindex=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
DestinationPort=445 NOT (Image="*svchost.exe" OR Image="*lsass.exe")
| bin _time span=1h
| stats dc(DestinationIp) AS TargetHosts, count AS Conns, values(DestinationIp) AS Targets
BY host, User, Image
| where TargetHosts >= 5
| sort - TargetHostsAtomic Red Team Tests
Uses PsExec to execute a benign command on a remote host, simulating lateral movement. Tests detection of PSEXESVC service creation and remote execution via admin share.
Command
psexec.exe \\<TARGET_HOST> -u <DOMAIN>\<ADMIN_USER> -p <PASSWORD> -accepteula ipconfig /allExpected Telemetry
On source: Sysmon Event ID 1 for psexec.exe, Sysmon Event ID 3 for SMB connection to target. On target: Windows Event ID 7045 (PSEXESVC service installed), Sysmon Event ID 11 (PSEXESVC.exe created in C:\Windows\), Security Event ID 4624 (network logon).
Expected Detection
Alert fires on PSEXESVC_Dropped indicator on target host (RiskScore=90) and PsExec_SuspiciousPath on source if dropped from non-standard path.