PsExec-Based Lateral Movement Detection

Rudra Verma@Rudraverma

•updated Jun 2, 2026•1•0•7

This rule detects the execution of PsExec or similar tools (psexec.exe, psexec64.exe, paexec.exe) which are commonly used for lateral movement within a network. It also identifies the use of PsExec service (psexesvc.exe) or command-line arguments indicative of PsExec activity, such as accessing administrative shares (ADMIN$, C$, IPC$) or the '-accepteula' flag.