PsExec
Last updated
The psexec / psexec64 commands work by uploading a service binary to the target system, then creating and starting a Windows service to execute that binary. Beacons executed this way run as SYSTEM.
\
\
A reliable way of searching for PsExec is by looking for 4697 service created events. These are often quite rare, unless a service comes with a software installation or something similar. Cobalt Strike generates a random 7-character alphanumeric string which it uses for both the service name and binary filename. When setting the binPath for the service, it uses a UNC path to the ADMIN$ share.
\
\
psexec_psh doesn't copy a binary to the target, but instead executes a PowerShell one-liner (always 32-bit). The pattern it uses by default is %COMSPEC% /b /c start /b /min powershell -nop -w hidden -encodedcommand ....
\
