PsExec Lateral Movement via PSEXESVC Process or Remote Cmdline

Ankit Mehta@Secvyn

•updated Jun 27, 2026•0•0•3

Detects the execution of the PsExec service (PSEXESVC) or command-line usage indicating remote service execution, including the standard PsExec '-accepteula' flag combined with network path indicators. Additionally detects the creation of the PSEXESVC service registry key, which is indicative of PsExec-based lateral movement or remote administration.