Lateral Movement PsExec SMB ADMIN$ Write and SVCCTL Named Pipe Access

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects network activity characteristic of the PsExec tool performing lateral movement. The rule monitors for SMB traffic directed at the ADMIN$ share, specifically looking for the creation or access of the 'PSEXESVC' service binary, combined with the use of the 'svcctl' named pipe, which is used by PsExec to remotely control services.