What is PsExec or admin-share abuse, and why does antivirus not flag it?
PsExec and similar tools run commands on a remote computer by copying a small service through its administrative file shares and starting it, and remote management protocols such as WinRM and remote desktop do similar work. Administrators use them every day, which is why antivirus usually lets them pass: the tool is signed and legitimate, and only the context is wrong. Attackers use them to spread from one machine to many, push ransomware to every server at once or run scripts with stolen administrator credentials. What gives them away is who uses them, from where and when: a workstation opening administrative sessions to servers it never used, at 01:30, or one account touching dozens of hosts within a few minutes. Restrict which machines may administer others. NetSenX flags such new host-to-host administrative sessions as lateral movement on every plan.
Read next
Related questions
- Can attackers move through our network with stolen passwords and no malware?
- Should we detect lateral movement from authentication logs or from network flows?
- What is graph-based detection of lateral movement?
- Do rule-based security tools miss new attack paths?
- Why would a printer scan our network, and can printers be used to attack other computers?