PsExec
- ID
- S0029
- Type
- Tool
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.[1][2]
Techniques used (5)
- T1021.002 SMB/Windows Admin Shares
- T1136.002 Domain Account
- T1543.003 Windows Service
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
Groups using it (39)
- G0003 Cleaver
- G0006 APT1
- G0008 Carbanak
- G0010 Turla
- G0016 APT29
- G0019 Naikon
- G0028 Threat Group-1314
- G0034 Sandworm Team
- G0035 Dragonfly
- G0037 FIN6
- G0045 menuPass
- G0049 OilRig
- G0053 FIN5
- G0059 Magic Hound
- G0061 FIN8
- G0076 Thrip
- G0077 Leafminer
- G0080 Cobalt Group
- G0087 APT39
- G0088 TEMP.Veles
- G0093 GALLIUM
- G0094 Kimsuky
- G0098 BlackTech
- G0102 Wizard Spider
- G0105 DarkVishnya
- G0114 Chimera
- G0117 Fox Kitten
- G0119 Indrik Spider
- G0125 HAFNIUM
- G1003 Ember Bear
- G1009 Moses Staff
- G1017 Volt Typhoon
- G1024 Akira
- G1032 INC Ransom
- G1040 Play
- G1043 BlackByte
- G1046 Storm-1811
- G1051 Medusa Group
- G1058 The Gentlemen