PsExec

A lightweight Sysinternals utility that executes processes on remote Windows systems with full interactivity for console applications — effectively a telnet replacement that requires no client software installed on the target beforehand. Part of the Sysinternals Suite now maintained by Microsoft. MITRE ATT&CK catalogs it as software S0029 under T1569.002 — System Services: Service Execution.

How it works

1. Copies an embedded service binary (PSEXESVC.exe) to the target’s ADMIN$ share over SMB (TCP 445)
2. Uses the Service Control Manager to install and start the PSEXESVC service on the target
3. Communicates with the service over named pipes (\pipe\psexesvc) for stdin/stdout/stderr redirection
4. On exit, stops and removes the service and deletes the binary

Because of this mechanism, PsExec requires administrative credentials on the target — it is a lateral-movement and administration tool, not an exploit.

Basic usage

psexec64.exe \\$TARGET_IP -u $TARGET_USER -p $TARGET_PASSWORD -i cmd.exe

• -s — run the remote process in the SYSTEM account (e.g., psexec64.exe -s cmd.exe for a local SYSTEM shell)
• -i — interact with the desktop of the specified session
• -c — copy a local program to the target before executing
• -h — run with the account’s elevated token (when UAC would normally strip it)

Omitting the target runs the command locally — psexec -s cmd.exe is the standard way to obtain a SYSTEM shell on the local machine, used in techniques like rdp-session-hijacking.

Detection

PsExec leaves distinctive artifacts:

• Service installation events — Windows event 7045 (service installed) for PSEXESVC; see windows-event-logs
• File creation of PSEXESVC.exe under %WINDIR%
• Named-pipe creation for \pipe\psexesvc (Sysmon event 17)
• Admin-share writes (ADMIN$) — see default-cifs-shares

Named-pipe squatting: a low-privileged local attacker can pre-create the expected named pipe to intercept a PsExec client’s session (fixed in PsExec v2.30+, which randomizes pipe names).

Sources

• PsExec - Sysinternals | Microsoft Learn
• mitre-attack-t1569-002
• mitre-attack-s0029
• microsoft-sysinternals-blog-sysmon-v13-01-psexec-v2-30-2021

Related: default-cifs-shares, rdp-session-hijacking, exploit-windows-services, windows-services, wmi-remote-service-execution