Transmission of PSEXESVC and its output file (-stdin, -stdout, -stderr) with SMB2.Įvidence That Can Be Confirmed When Execution is Successful ¶

The fact that PSEXESVC.exe was created and accessed, and that connection was made from the source via the network, as well as the command name and argument for a remotely executed command are recorded (audit policy, Sysmon). The fact that the PsExec process was executed and that connection was made to the destination via the network, as well as the command name and argument for a remotely executed command are recorded (audit policy, Sysmon). The fact that the PSEXESVC service has been installed, started, and ended is recorded (system log). A registry value created when the PsExec License Agreement has been agreed to (registry). 88/tcp (when executing in a domain environment) - 135/tcp - 445/tcp - Random High Port The tool is used to execute a remote command on hosts and servers in a domain.

Example of Presumed Tool Use During an Attack ¶ Use PsExec.exe to execute commands on a remote Windows systemĮxecutes a command on a remote host. Most variations of this technique share similar IOCs. This is just only procedure of a larger set of techiques. This document highlights key IOCs generated when the SysInternals version of PsExec SysInternals PsExecis used. It is important to understand what indicators a tool may leave behind before using on a Red Team engagement. PsExec.exe is a tool commonly used by system administrators, penetration testers, and threat actors. New Information Security and Red Teaming Blog Threat Express by MINISĮxample of Presumed Tool Use During an AttackĮvidence That Can Be Confirmed When Execution is Successful SubShell and TinyShell - Custom Covert Webshells Leveraging Expired Domains for Red Team Engagements Threat Get's a Vote - Applying a Threat-Based Approach to Security TestingĪutomating Cobalt Strike Profiles Apache mod_rewrite htaccess Files for Intelligent C2 Redirectionīorrowing Microsoft MetaData and Signatures to Hide Binary Payloads

A Deep Dive into Cobalt Strike Malleable C2

Psexec