MITRE ATT&CKsoftware (tool)

S0029 PsExec

Published 2017-05-31 Modified 2026-05-12 Official page ↗

Domain: enterprise
Platforms: Windows
Version: 1.7
Created: 2017-05-31

Description

PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.

Related

Uses · MITRE ATT&CK (5)

T1570 Lateral Tool Transfer technique
T1569.002 Service Execution sub-technique
T1021.002 SMB/Windows Admin Shares sub-technique
T1136.002 Domain Account sub-technique
T1543.003 Windows Service sub-technique

Referenced by MITRE ATT&CK · uses (45)

G1058 The Gentlemen group
C0063 2025 Poland Wiper Attacks campaign
C0058 SharePoint ToolShell Exploitation campaign
G1051 Medusa Group group
G1046 Storm-1811 group
G1043 BlackByte group
G1040 Play group
G1032 INC Ransom group
G1024 Akira group
G1017 Volt Typhoon group
C0023 Operation Ghost campaign
C0014 Operation Wocao campaign
C0004 CostaRicto campaign
C0002 Night Dragon campaign
G1009 Moses Staff group
G1003 Ember Bear group
G0125 HAFNIUM group
G0119 Indrik Spider group
G0117 Fox Kitten group
G0114 Chimera group
G0105 DarkVishnya group
G0102 Wizard Spider group
G0098 BlackTech group
G0094 Kimsuky group
G0093 GALLIUM group
G0088 TEMP.Veles group
G0087 APT39 group
G0076 Thrip group
G0077 Leafminer group
G0080 Cobalt Group group

Show all 45 ›

References

https://www.sans.org/blog/protecting-privileged-domain-accounts-psexec-deep-dive/ SANS PsExec
https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx Russinovich Sysinternals