PsExec test

PsExec.exe \\<target> cmd

Executes PsExec against the test host, validating detection of lateral movement via remote service execution.

Run it in the purple team lab when you want to validate lateral movement detection: PsExec (the Sysinternals tool) executes processes remotely by creating a service — the classic lateral movement method (and the one used by actors with their variants). The team verifies what was detected — Event 7045 (service created), 4624 (logon), Sysmon Event 1 (PSEXESVC), SIEM rules, EDR. It's lateral movement validation with the real tool: 7045 + the PsExec pattern are the classic signature. In purple teaming, PsExec validates lateral movement detection via service.

Do not run it outside the lab: PsExec creates the service on the target (real change) — the test host is the place. And note: PsExec is legitimate and signed — detection relies on the pattern (PSEXESVC service, 7045, logon with credentials) and context (source, unusual usage); validation measures those layers. Variants (Sysinternals' vs actors') generate slightly different patterns: validating the official variant covers the base pattern. Cleanup (PSEXESVC service on the target) upon completion.