Loading interactive filters…
1200KM / tool
PsExec — Attack Tool
PsExec is a free Microsoft tool that can be used to execute a program on another computer. It is used by IT administrators and attackers.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: PsExec
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Cleaver · G0003 · Pinned relationship source (relationship--3cd8ef78-9d92-4e28-97ae-5bd6c698bfec)
- APT1 · G0006 · Pinned relationship source (relationship--2d0afb20-dfbd-4f6b-bd75-ee67d8eeb8c6)
- Carbanak · G0008 · Pinned relationship source (relationship--d0f797ce-9176-4b74-8d64-fad4e1bdef4f)
- Turla · G0010 · Pinned relationship source (relationship--08fccacb-803c-4d00-baa7-ed6af83660ae)
- APT29 · G0016 · Pinned relationship source (relationship--ba1a4084-a74f-44d6-bafe-7a09ee959270)
- Naikon · G0019 · Pinned relationship source (relationship--f08c1f67-485b-4ebd-81dd-e886f63025e6)
- Threat Group-1314 · G0028 · Pinned relationship source (relationship--f1af286d-9367-45de-aced-a762838e58bd)
- Sandworm Team · G0034 · Pinned relationship source (relationship--4d1f00f6-30cc-48b6-baef-66a7fe3cbe86)
- Dragonfly · G0035 · Pinned relationship source (relationship--e068332d-0b1c-4aba-a60f-37c640e20d10)
- FIN6 · G0037 · Pinned relationship source (relationship--9c8fa95a-cbbe-4ef6-999d-21b4080b54f6)
- menuPass · G0045 · Pinned relationship source (relationship--f9600732-9116-4325-8073-28d81721b37a)
- OilRig · G0049 · Pinned relationship source (relationship--e1a3f5df-963d-4211-931e-02ed9c567168)
- FIN5 · G0053 · Pinned relationship source (relationship--7e46e7c8-e48a-4860-bbcd-224a2d12284a)
- Magic Hound · G0059 · Pinned relationship source (relationship--e1910051-019d-4594-ab9d-b588eb370ff2)
- FIN8 · G0061 · Pinned relationship source (relationship--d7dd3cdf-f928-4ca3-8fba-0c948eb36c16)
- Thrip · G0076 · Pinned relationship source (relationship--307f4aac-212f-4c81-9764-d0acf7ca0e55)
- Leafminer · G0077 · Pinned relationship source (relationship--d2a8729f-6271-46a0-8a40-a8567c9e5092)
- Cobalt Group · G0080 · Pinned relationship source (relationship--e46dc495-5581-471c-84b5-b0dd825471f9)
- APT39 · G0087 · Pinned relationship source (relationship--66e8d05b-6f51-461d-aec0-266970064939)
- TEMP.Veles · G0088 · Pinned relationship source (relationship--a8068bc5-7382-448b-9583-1f61edb68b96)
- GALLIUM · G0093 · Pinned relationship source (relationship--b3295bb6-356b-4f8e-b921-ec96d249c66b)
- Kimsuky · G0094 · Pinned relationship source (relationship--b20c6b3c-1314-419e-afa2-28ac8f54cf39)
- BlackTech · G0098 · Pinned relationship source (relationship--36f159f7-5018-4889-a540-98e3ac242602)
- Wizard Spider · G0102 · Pinned relationship source (relationship--fc19dd7e-415d-4e27-92bd-262392b6d38f)
- DarkVishnya · G0105 · Pinned relationship source (relationship--475fef11-3344-4305-9710-cc41ba8acc0a)
- Chimera · G0114 · Pinned relationship source (relationship--0a3dbe33-465a-421e-82ca-573d2ca25691)
- Fox Kitten · G0117 · Pinned relationship source (relationship--d9a97894-9a90-43cd-b9b9-9d13545aeb5a)
- Indrik Spider · G0119 · Pinned relationship source (relationship--a5b41632-a553-4abe-aa68-9ce6898e642d)
- HAFNIUM · G0125 · Pinned relationship source (relationship--577f5fe4-3fb4-4969-a5a4-5b7c1bc693a8)
- Ember Bear · G1003 · Pinned relationship source (relationship--c2384bea-763a-4782-ba88-15a75d83f61b)
- Moses Staff · G1009 · Pinned relationship source (relationship--335efe06-4f71-43cb-ab93-c812157d0078)
- Volt Typhoon · G1017 · Pinned relationship source (relationship--0396cca6-52e9-4553-8fa2-68d482c76ddd)
- Akira · G1024 · Pinned relationship source (relationship--5b8fab1d-c033-487b-a9c5-c699a0f11907)
- INC Ransom · G1032 · Pinned relationship source (relationship--496f7931-6abd-4485-953b-0b8854c8ecab)
- Play · G1040 · Pinned relationship source (relationship--6f376a6a-a5ca-4e06-93c5-87d9a76a59ac)
- BlackByte · G1043 · Pinned relationship source (relationship--bc56eda5-37e8-4478-a0e6-ea73fc6a57ed)
- Storm-1811 · G1046 · Pinned relationship source (relationship--5158f210-229d-438e-ae98-cc118ee6c371)
- Medusa Group · G1051 · Pinned relationship source (relationship--d329f896-6016-46b6-a66c-3e57964f95ab)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
- Command Execution · DC0064
- Driver Load · DC0079
- File Creation · DC0039
- File Metadata · DC0059
- Logon Session Creation · DC0067
- Network Connection Creation · DC0082
- Network Share Access · DC0102
- Process Creation · DC0032
- Service Creation · DC0060
- User Account Authentication · DC0002
- User Account Creation · DC0014
- Windows Registry Key Modification · DC0063
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.