PsExec-style Lateral Movement with Suspicious Payload Execution

Georgios Maragos@Gmarak

•updated Jul 20, 2026•1•0•12

Detects lateral movement patterns involving PsExec or PSEXESVC where either a suspicious command-line flag (e.g., '-psex') is present or the PsExec service spawns child processes like cmd.exe or powershell.exe executing suspicious, obfuscated, or remotely retrieved payloads.