Tool: PsExec

Description

[PsExec](https://attack.mitre.org/software/S0029) is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.(Citation: Russinovich Sysinternals)(Citation: SANS PsExec)

External References

• mitre-attack
• SANS PsExec
• Russinovich Sysinternals

Techniques Used by This Tool

• T1021.002 — SMB/Windows Admin Shares
• T1136.002 — Domain Account
• T1543.003 — Windows Service
• T1569.002 — Service Execution
• T1570 — Lateral Tool Transfer

APT Groups Using This Tool

• Indrik Spider
• Wizard Spider
• Dragonfly
• OilRig
• Fox Kitten
• BlackTech
• Play
• Sandworm Team
• Turla
• Ember Bear
• FIN6
• Volt Typhoon
• Leafminer
• Magic Hound
• APT29
• Cobalt Group
• HAFNIUM
• APT39
• Kimsuky
• Storm-1811
• Akira
• Chimera
• menuPass
• Moses Staff
• DarkVishnya
• Threat Group-1314
• INC Ransom
• GALLIUM
• FIN8
• BlackByte
• APT1
• Naikon
• FIN5
• Cleaver
• TEMP.Veles
• Carbanak
• Thrip