Detection of PsExec Execution

PsExec is a legitimate administration tool from the Windows Sysinternals suite frequently abused by threat actors to facilitate lateral movement and remote code execution. Attackers leverage PsExec to execute processes on remote systems using administrative credentials, bypassing standard authentication hurdles. Because PsExec requires an initial acceptance of an End User License Agreement (EULA) upon first run on a system, threat actors often include the -accepteula flag in their command-line arguments to ensure automated, non-interactive execution. Defenders should monitor for the invocation of PsExec to identify unauthorized administrative activity and potential lateral movement across the network.

Impact

Successful unauthorized use of PsExec allows attackers to pivot within an environment, execute arbitrary commands with SYSTEM privileges, deploy malware, or establish persistence. Its use is associated with various ransomware operations and state-sponsored espionage campaigns where lateral movement is a core objective.

Recommendation

Deploy the provided Sigma rule to identify PsExec execution. Prioritize investigating command lines involving the -accepteula flag. Establish a process to inventory legitimate administrative use of PsExec and add these specific workstations or service accounts to a monitor-only allowlist to reduce noise. Enable Sysmon or Windows Event Log ID 4688 to capture the required process creation telemetry.