Scenario: An IDS alert flagged suspicious lateral movement involving PsExec — Sysinternals'
legitimate remote-execution tool, and one of the most common living-off-the-land techniques for spreading across a
compromised network. As a SOC analyst, the task is to trace the attacker's entry point, every machine they touched,
and exactly how PsExec was used to install and run a remote service, purely from SMB traffic in a PCAP.
How PsExec Lateral Movement Works
PsExec works by authenticating to a target over SMB, uploading its service binary (
PSEXESVC.exe) to the
ADMIN$ share, using the Service Control Manager (DCERPC) to install and start it as a Windows service,
then communicating with that service over the IPC$ named-pipe share to relay commands and output. Every
step of that — the file upload, the service install, and the interactive shell — leaves distinct SMB2 traffic behind,
which makes PsExec one of the more reliably detectable lateral-movement techniques in packet captures, provided you
know which filters to reach for.
Q1Can you identify the IP address of the machine from which the attacker initially gained access?
Statistics → Conversations → IPv4 immediately shows one host dominating the traffic volume against two separate targets — 38,284 packets / 7 MB to one machine and 1,755 packets / 1 MB to another — the classic signature of an attacker actively working from a single foothold.
answer10.0.0.130
Q2Can you determine the machine's hostname to which the attacker first pivoted?
ntlmssp.challenge.target_name
The NTLM challenge response for the first authentication exchange carries the target's NetBIOS/DNS computer name directly in its Target Info block.
answerSALES-PC
Q3What is the username utilized by the attacker for authentication?
ntlmssp.auth.username
The NTLMSSP_AUTH request that follows the challenge carries the authenticating username in plaintext within the SMB2 session setup.
answerssales
Q4What's the name of the service executable the attacker set up on the target?
File → Export Objects → SMB lists every file transferred over the session — including
PSEXESVC.exe being written to both targets' ADMIN$ shares, alongside its stdin/stdout/stderr named-pipe artifacts and per-run .key files.answerPSEXESVC.exe
Q5Which network share was used by PsExec to install the service on the target machine?
smb2.tree
The Tree Connect Request immediately preceding the
PSEXESVC.exe upload targets \\10.0.0.133\ADMIN$ — the standard Windows administrative share PsExec always uses to drop its service binary.answerADMIN$
Q6Which network share did PsExec use for communication?
smb2.tree
Following the same TCP stream, a second Tree Connect targets
\\10.0.0.133\IPC$ — the named-pipe share PsExec uses to talk to the freshly installed service and relay the interactive session.answerIPC$
Q7What is the hostname of the second machine the attacker targeted to pivot within our network?
ntlmssp.challenge.target_name
The same NTLM challenge filter applied against the second authenticated session reveals a separate target hostname — confirming the attacker moved beyond the first compromised host.
answermarketing-PC
IOC Summary
| Item | Value |
|---|---|
| Attacker IP | 10.0.0.130 |
| First Pivot Hostname | SALES-PC |
| Compromised Username | ssales |
| Service Executable | PSEXESVC.exe |
| Install Share | ADMIN$ |
| Communication Share | IPC$ |
| Second Pivot Hostname | marketing-PC |
Lessons learned: PsExec is dual-use by design — it's a legitimate Sysinternals admin tool, which
is exactly why attackers favor it for lateral movement: it blends into normal IT activity far better than a custom
implant would. The
PSEXESVC.exe service name and its ADMIN$ upload followed immediately by
IPC$ pipe traffic is a near-unique fingerprint worth building a detection rule around directly, rather
than trying to signature the payload itself. ntlmssp.auth.username and
ntlmssp.challenge.target_name are the two filters that do most of the work in this class of
investigation — they hand over the compromised account and every pivot hostname without needing to touch
credentials or decrypt anything.