Skip to content

PsExec

Software · ATTACK:enterprise:S0029

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0029",
  "title": "PsExec",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0029",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--ff6caf67-ea1f-4895-b80e-4bb0fc31c6db",
  "external_id": "S0029",
  "domain": "enterprise",
  "created": "2017-05-31T21:32:21.771Z",
  "modified": "2026-05-12T15:12:00.741Z",
  "version": "1.7",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "SANS PsExec",
      "url": "https://www.sans.org/blog/protecting-privileged-domain-accounts-psexec-deep-dive/"
    },
    {
      "source_name": "Russinovich Sysinternals",
      "url": "https://technet.microsoft.com/en-us/sysinternals/bb897553.aspx"
    }
  ]
}

Explicit source assertions (50)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0396cca6-52e9-4553-8fa2-68d482c76ddd

CISA AA24-038A PRC Critical Infrastructure February 2024

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08fccacb-803c-4d00-baa7-ed6af83660ae

Symantec Waterbug Jun 2019

ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0a3dbe33-465a-421e-82ca-573d2ca25691

NCC Group Chimera January 2021

ATTACK:enterprise:C0058 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1195fdb7-59c3-4426-ba2d-ac86d079ddf9

Microsoft SharePoint Exploit JUL 2025

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1021.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--27102940-8ec1-42ad-98e5-57dc24b572eb

PsExec Russinovich

ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d0afb20-dfbd-4f6b-bd75-ee67d8eeb8c6

ATTACK:enterprise:G0076 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--307f4aac-212f-4c81-9764-d0acf7ca0e55

Symantec Thrip June 2018

ATTACK:enterprise:G1009 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--335efe06-4f71-43cb-ab93-c812157d0078

Checkpoint MosesStaff Nov 2021

ATTACK:enterprise:G0098 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--36f159f7-5018-4889-a540-98e3ac242602

Symantec Palmerworm Sep 2020

ATTACK:enterprise:G0003 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3cd8ef78-9d92-4e28-97ae-5bd6c698bfec

Cylance Cleaver

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1543.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--43b00ad2-2d54-4ca9-a0a2-a0cb1a5fa7ff

Russinovich Sysinternals

ATTACK:enterprise:G0105 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--475fef11-3344-4305-9710-cc41ba8acc0a

Securelist DarkVishnya Dec 2018

ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--496f7931-6abd-4485-953b-0b8854c8ecab

Secureworks GOLD IONIC April 2024 · Cybereason INC Ransomware November 2023 · SOCRadar INC Ransom January 2024 · Huntress INC Ransom Group August 2023

ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4d1f00f6-30cc-48b6-baef-66a7fe3cbe86

Dragos Crashoverride 2018

ATTACK:enterprise:G1046 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5158f210-229d-438e-ae98-cc118ee6c371

Microsoft Storm-1811 2024

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--577f5fe4-3fb4-4969-a5a4-5b7c1bc693a8

Volexity Exchange Marauder March 2021

ATTACK:enterprise:G1024 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5b8fab1d-c033-487b-a9c5-c699a0f11907

Arctic Wolf Akira 2023

ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--63c88ce8-ab45-4640-b9e1-8254018fc9cc

ATTACK:enterprise:G0087 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--66e8d05b-6f51-461d-aec0-266970064939

FireEye APT39 Jan 2019 · BitDefender Chafer May 2020 · Symantec Chafer February 2018

ATTACK:enterprise:G1058 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6ef4eef0-675f-4217-8ade-811b0608ea90

TrendAI_TheGentlemen_Sept2025

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f376a6a-a5ca-4e06-93c5-87d9a76a59ac

CISA Play Ransomware Advisory December 2023

ATTACK:enterprise:G0053 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7e46e7c8-e48a-4860-bbcd-224a2d12284a

Mandiant FIN5 GrrCON Oct 2016

ATTACK:enterprise:C0004 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7edbf524-1324-4c2b-b3ea-8bc1007943c4

BlackBerry CostaRicto November 2020

ATTACK:enterprise:G0037 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c8fa95a-cbbe-4ef6-999d-21b4080b54f6

FireEye FIN6 April 2016 · FireEye FIN6 Apr 2019

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1570

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f5c68fe-a32e-405d-ae58-0965f04855cb

PsExec Russinovich

ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a5b41632-a553-4abe-aa68-9ce6898e642d

Symantec WastedLocker June 2020

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1569.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a66aff09-0635-44a3-b591-a530a25c9012

Russinovich Sysinternals

ATTACK:enterprise:G0088 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a8068bc5-7382-448b-9583-1f61edb68b96

FireEye TRITON 2019 · Dragos Xenotime 2018

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b20c6b3c-1314-419e-afa2-28ac8f54cf39

Netscout Stolen Pencil Dec 2018

ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b3295bb6-356b-4f8e-b921-ec96d249c66b

Cybereason Soft Cell June 2019 · Microsoft GALLIUM December 2019

ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b532ff8b-5bb2-4f62-9d4c-373ec92cfca0

McAfee Night Dragon

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b8ca4610-ccb2-4e29-8478-8670413af4f9

FoxIT Wocao December 2019

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ba1a4084-a74f-44d6-bafe-7a09ee959270

F-Secure The Dukes · ESET Dukes October 2019

ATTACK:enterprise:S0029 → uses → ATTACK:enterprise:T1136.002

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bbdea723-700c-409e-8992-e15c4bd16654

NCC Group Fivehands June 2021

ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bc56eda5-37e8-4478-a0e6-ea73fc6a57ed

Microsoft BlackByte 2023

ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c2384bea-763a-4782-ba88-15a75d83f61b

CISA GRU29155 2024

ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d0f797ce-9176-4b74-8d64-fad4e1bdef4f

Kaspersky Carbanak

ATTACK:enterprise:G0077 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2a8729f-6271-46a0-8a40-a8567c9e5092

Symantec Leafminer July 2018

ATTACK:enterprise:G1051 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d329f896-6016-46b6-a66c-3e57964f95ab

CISA Medusa Group Medusa Ransomware March 2025

ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d7dd3cdf-f928-4ca3-8fba-0c948eb36c16

Symantec FIN8 Jul 2023

ATTACK:enterprise:G0117 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d9a97894-9a90-43cd-b9b9-9d13545aeb5a

CISA AA20-259A Iran-Based Actor September 2020 · Check Point Pay2Key November 2020

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e068332d-0b1c-4aba-a60f-37c640e20d10

Secureworks IRON LIBERTY July 2019 · US-CERT TA18-074A · Symantec Dragonfly Sept 2017 · Gigamon Berserk Bear October 2021

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1910051-019d-4594-ab9d-b588eb370ff2

FireEye APT35 2018

ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e1a3f5df-963d-4211-931e-02ed9c567168

FireEye APT34 Webinar Dec 2017

ATTACK:enterprise:G0080 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e46dc495-5581-471c-84b5-b0dd825471f9

PTSecurity Cobalt Group Aug 2017 · Group IB Cobalt Aug 2017

ATTACK:enterprise:C0023 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ead3f010-b221-4708-bb1e-d146f2593be5

ESET Dukes October 2019

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f08c1f67-485b-4ebd-81dd-e886f63025e6

Baumgartner Naikon 2015

ATTACK:enterprise:G0028 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f1af286d-9367-45de-aced-a762838e58bd

ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f9600732-9116-4325-8073-28d81721b37a

FireEye APT10 April 2017 · PWC Cloud Hopper Technical Annex April 2017

ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0029

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc19dd7e-415d-4e27-92bd-262392b6d38f

CrowdStrike Grim Spider May 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Mandiant FIN12 Oct 2021

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.