Skip to main content

PsExec

This is a defensive tool-intelligence page. It is intended for analyst navigation, source review, and hunt planning. It is not a malware-analysis report and does not contain sample code or binaries.

Summary​

  • Associated actor(s): OilRig; Magic Hound; APT39
  • Tool type(s): Remote execution utility
  • Confidence level(s): Medium
  • Source ID(s): SRC-MITRE-G0049, SRC-MITRE-G0059, SRC-MITRE-G0087

Behavior​

ActorBehavior Summary
APT39MITRE ATT&CK lists PsExec as software used by this actor; track it as service-based lateral execution behavior.
Magic HoundMITRE ATT&CK lists PsExec as software used by this actor; track it as service-based lateral execution behavior.
OilRigMITRE ATT&CK lists PsExec as software used by this actor; track it as service-based lateral execution behavior.

Hash And IOC Status​

ActorStatusReference
APT39Hash not committed; use the linked MITRE references and original source reports for current IOCs.SRC-MITRE-G0087
Magic HoundHash not committed; use the linked MITRE references and original source reports for current IOCs.SRC-MITRE-G0059
OilRigHash not committed; use the linked MITRE references and original source reports for current IOCs.SRC-MITRE-G0049

Hashes and IOCs on this page are source pointers or representative public indicators. They SHOULD be refreshed from the linked source before operational use and MUST NOT be used alone for actor attribution.

Defensive Hunting Notes​

ActorHunting Notes
APT39Hunt for PsExec execution or artifacts only in context: unusual parent process, unexpected host role, suspicious account, external staging, or proximity to the actor intrusion chain.
Magic HoundHunt for PsExec execution or artifacts only in context: unusual parent process, unexpected host role, suspicious account, external staging, or proximity to the actor intrusion chain.
OilRigHunt for PsExec execution or artifacts only in context: unusual parent process, unexpected host role, suspicious account, external staging, or proximity to the actor intrusion chain.

Handling Notes​

ActorHandling Notes
APT39Common or dual-use tools require local allowlisting and must not be used alone for actor attribution.
Magic HoundCommon or dual-use tools require local allowlisting and must not be used alone for actor attribution.
OilRigCommon or dual-use tools require local allowlisting and must not be used alone for actor attribution.

Mapped ATT&CK Techniques For Associated Actor(s)​

ActorTechniqueTacticMapping QualitySource
OilRigT1505.003 Web ShellPersistenceM3SRC-MITRE-G0049
OilRigT1049 System Network Connections DiscoveryDiscoveryM1SRC-MITRE-G0049
Magic HoundT1566.002 Spearphishing LinkInitial AccessM2SRC-MITRE-G0059
Magic HoundT1583.001 Acquire DomainsResource DevelopmentM1SRC-MITRE-G0059
APT39T1566.001 Spearphishing AttachmentInitial AccessM2SRC-MITRE-G0087
APT39T1003.001 LSASS MemoryCredential AccessM2SRC-MITRE-G0087

These detections are mapped through the associated actor or scenario and are not automatically tool-specific. Promote a tool-specific detection only after the behavior is tied to telemetry and test evidence.

ActorDetectionRelease StatusDRLRule
Magic HoundDET-004 - Mail Click To Execution CorrelationHunt4detections/kql/mail-click-to-exec-correlation.kql

These hunts are mapped through the associated actor or scenario and may need narrowing before they are used for this specific tool.

ActorHuntHypothesisQuery
Magic HoundHUNT-004If VIP phishing is active then mail click events will correlate to risky sign-in or executiondetections/kql/mail-click-to-exec-correlation.kql

Source Review​

SourcePublisherDateReliabilityTypeLast Reviewed
SRC-MITRE-G0049MITRE ATT&CK2026-05-13AKnowledge base2026-05-14
SRC-MITRE-G0059MITRE ATT&CK2026-05-13AKnowledge base2026-05-14
SRC-MITRE-G0087MITRE ATT&CK2026-05-14AKnowledge base2026-05-14

If a source publishes a large or frequently changing IOC appendix, keep the current IOC list in the source system or TIP and store only the pointer here.