🧰 PsExec

The items that name it 7

• IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
  articleas classification.technologies2026-10-29
• Huntress: How Attackers Abuse VSS, and How Huntress Detects It
  articleas tools2026-09-15

  Legitimate admin tool used by the attacker in the described incident to spawn SYSTEM-level command shell processes on a domain controller

• CitrixBleed 2 (CVE-2025-5777) 7Steps to Dragonforce Ransomware | Huntress
  writeupas tools2026-07-09

  Used by the operator with -s flag to obtain a SYSTEM shell for lateral movement/execution.

• Decoding NightSpire: Ransomware IOCs Aren't Set in Stone
  writeupas tools2026-04-07

  Native/administrative utility ('LOLBin') publicly reported as used in other NightSpire attacks, though not observed in the incident Huntress investigated

• Data Exfiltration and Threat Actor Infrastructure Exposed
  writeupas tools2026-03-12

  Microsoft-provided utility used by threat actor to elevate privileges

• ELearnSecurity Certified Threat Hunting Professional (eCTHPv2) review
  articleas tools2022-07-10

  Tool whose detection/hunting is taught as part of endpoint threat hunting

• #StopRansomware: SafePay Ransomware (AA26-293A)
  advisoryas toolsIt is written here as PsExec: used by SafePay actors for remote command execution and lateral movement.