Lateral Movement via SMB PsExec ADMIN$ Share and PSEXESVC Upload

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

This rule detects network traffic indicative of PsExec lateral movement, specifically identifying the authentication or access to the hidden 'ADMIN$' network share followed by the transfer or execution of the 'PSEXESVC' service binary, a hallmark of the PsExec tool.