Ransomware Series: The Gentlemen Ransomware PsExec-Based Lateral Movement

Ibrahim Saud@tektrix

•updated Sep 25, 2026•2•0•3

Detects the use of PsExec to remotely execute binaries on target hosts, a technique observed in The Gentlemen ransomware lateral movement phase when domain controller access is unavailable. The rule identifies psexec.exe process creation with common flags (-s, -d, -c) while filtering out common administrative parent processes.