How do you detect PsExec lateral movement?

Detect PsExec by watching for the remote service install it requires: Event ID 7045 in the System log and 4697 in the Security log, where the ImagePath points at an executable in the Windows directory or an ADMIN$ path, plus the stock service name PSEXESVC. Correlate that install with a type 3 network logon from the same source and with the SMB write of the binary (Event 5145 or Sysmon 11), then add Sysmon 17/18 pipe events for PSEXESVC-* pipes. Clones such as Impacket and Cobalt Strike use random names, so alert on the behaviour (remote install, system-path binary, interpreter child of services.exe) rather than the string. Allowlist your approved deployment tools and administration hosts.

Detecting PsExec and Service-Based Remote Execution

PsExec copies a service binary to the ADMIN$ share, installs it through the Service Control Manager over RPC and talks to it over named pipes. Every step leaves telemetry on the target, and the same pattern is reused by Impacket, Cobalt Strike’s psexec command, RemCom and PAExec. Detecting the pattern rather than the tool name keeps you ahead of simple renames.

Signals at a Glance

Signal	Where	ATT&CK
New service whose ImagePath points at an executable in the Windows directory or an ADMIN$ path (Event 7045 / 4697)	System and Security logs	T1569.002
Executable written over SMB to ADMIN$ by the System process	Sysmon 11, Event 5145	T1021.002
PSEXESVC-* named pipes (stdin, stdout, stderr)	Sysmon 17/18, Event 5145	T1569.002
Service-launched child such as cmd.exe or powershell.exe under services.exe	Sysmon 1, Event 4688	T1543.003
PsExec EULA value set on the source host	Sysmon 13	T1569.002

Service Creation and Binary Drop

The most reliable PsExec artifact is the service install. Event ID 7045 (System log, Service Control Manager) and 4697 (Security log) record the service name and ImagePath. The stock tool uses the name PSEXESVC; clones use random names and binaries, so alert on the structure of the install as well as the string:

title: Remote Service Install Resembling PsExec
logsource:
  product: windows
  service: system
detection:
  stock:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
    ServiceName: 'PSEXESVC'
  generic:
    Provider_Name: 'Service Control Manager'
    EventID: 7045
    ImagePath|contains:
      - '\\127.0.0.1\ADMIN$\'
      - '%SystemRoot%\'
      - 'C:\Windows\'
  filter_known_tools:
    ImagePath|contains: '<your approved deployment tool path>'
  condition: stock or (generic and not filter_known_tools)
level: high
# tune/validate: baseline legitimate software installers that register services from C:\Windows.

Correlate the install with the network logon that preceded it. The binary arrives over SMB, so a Security 5145 or Sysmon 11 file-create under the Windows directory should appear within seconds of the 7045:

// Sentinel (KQL) - service install shortly after a network logon from the same source
let installs = SecurityEvent
| where EventID == 4697
| where ServiceFileName has_any ("ADMIN$", "PSEXESVC", "%COMSPEC%", "\\127.0.0.1")
| project InstallTime=TimeGenerated, Computer, ServiceName, ServiceFileName, SubjectUserName, SubjectLogonId;
installs
| join kind=inner (
    SecurityEvent
    | where EventID == 4624 and LogonType == 3
    | project LogonTime=TimeGenerated, Computer, TargetLogonId, SourceIp=IpAddress, TargetUserName
) on Computer, $left.SubjectLogonId == $right.TargetLogonId
| project InstallTime, Computer, ServiceName, ServiceFileName, TargetUserName, SourceIp
// tune/validate: field names vary by connector; confirm 4697 is audited (Security System Extension).

Pipes, Renames and Variants

PsExec opens three named pipes per session, PSEXESVC-<host>-<pid>-stdin, -stdout and -stderr. Sysmon Event IDs 17 and 18 capture them, and Event 5145 on the IPC$ share records the client touching them. Variants change the strings but keep the shape: a service is created remotely, an executable lands in a system path, and a command interpreter runs as its child.

Alert on any child of services.exe that is cmd.exe or powershell.exe on servers where that never happens, and rank by the account that opened the preceding type 3 logon.
Watch the source host as well: psexec.exe execution and the HKCU\Software\Sysinternals\PsExec EulaAccepted value show who is running the tool and from where.
Treat Impacket psexec.py and Cobalt Strike psexec as the same behaviour: random service name, random eight-character binary, ImagePath often pointing at an ADMIN$ path.
Keep an allowlist of administration hosts and accounts that legitimately use PsExec; alert on every other source-to-destination pair.

Vetted sources

Start from the SigmaHQ service-install and PsExec rules, Elastic and Splunk ESCU remote-service content, and MITRE CAR analytics for remote execution. Use Atomic Red Team to generate the telemetry and the SwiftOnSecurity or Olaf Hartong Sysmon configuration for pipe and file events. Baseline your own environment first — software deployment and EDR agents also install services remotely.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

Service Creation and Binary Drop

Pipes, Renames and Variants

Build Detections That Fire

Lateral Movement Detection

Detection Hub

Remote Service Creation Detection

smbexec Detection