CmdID

CmdID / Commands

psexec

Execute a command-line process on a remote machine. tldr-pages

On Windows 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Windows

from tldr-pages, CC BY 4.0

Execute a command-line process on a remote machine. This is an advanced command and it might potentially be dangerous.

Execute a command using cmd in a remote shell

psexec \\remote_host cmdIdentify

Trips 1 Sigma rule: mediumPsexec Execution by omkar72

Execute a command on a remote host (pre-authenticated)

psexec \\remote_host -u user_name -p passwordIdentify

Trips 1 Sigma rule: mediumPsexec Execution by omkar72

Execute a command remotely and output the result to a file

psexec \\remote_host cmd /c command -an ^>path\to\file.txtIdentify

Trips 1 Sigma rule: mediumPsexec Execution by omkar72

Execute a program to interact with users

psexec \\remote_host -d -i program_nameIdentify

Trips 1 Sigma rule: mediumPsexec Execution by omkar72

Display the IP configuration of the remote host

psexec \\remote_host ipconfig /allIdentify

Trips 2 Sigma rules: mediumPsexec Execution by omkar72; lowSuspicious Network Command by frack113, Christopher Peacock '@securepeacock', SCYTHE '@scythe_io'

What detects it

Sigma process creation rules that name psexec
highPotential Defense Evasion Via Rename Of Highly Relevant BinariesMatthew Green - @mgreen27, Florian Roth (Nextron Systems), frack113
mediumPotential Binary Impersonating Sysinternals Toolsfrack113, Swachchhanda Shrawan Poudel (Nextron Systems)
mediumPsexec Executionomkar72