PsExec Lateral Movement - PSEXESVC Named Pipe or ADMIN$ EXE Write via SMB

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects network traffic associated with PsExec lateral movement activity, specifically looking for the creation of the PSEXESVC named pipe over SMB/ADMIN$ shares, which is commonly used by PsExec to remotely execute services and commands on target systems.