PsExec Remote Service Execution with Administrative Credentials

Daniel Jeremiah@daniyyell

•updated Jun 21, 2026•0•0•3

Detects the execution of PsExec (psexec.exe or psexec64.exe) with command-line arguments indicating remote execution to a network share and the use of administrative credentials (e.g., -s, -u, -p, -c). This activity is often associated with lateral movement and remote service execution by attackers, including ransomware groups like 'The Gentlemen'.