Sign In
- Platform
- Solutions
- Modern NDR
- Resources
- Company
Platform
Modern NDR
Resources
Company
Platform
Modern NDR
Resources
Company
DETECTION OVERVIEW
Risk Factors
An attacker must acquire admin credentials, lowering the likelihood of this technique. If the attacker is able to launch a service, the impact depends on which devices are compromised and the details of the newly configured service.
The system might change the risk score for this detection.
Category
After an attacker with admin credentials remotely launches a service on a device, the effects can range from minor configuration changes to remote command execution (RCE). One tool, PsExec, has been associated with known lateral movement techniques. PsExec, which is part of the Windows Sysinternals utilities, enables administrators to run remote commands by copying an executable file to the remote ADMIN$ share and then creating a temporary service to run that executable file.
System administrators might often remotely launch services on a device. This legitimate activity can appear similar to lateral movement activity.
Require User Account Control (UAC) approvals for any PsExec operations by enabling FilterAdministratorToken (Admin Approval Mode for the built-in Administrator account) in the Windows registry
Disable the ability to download software utility tools such as AppLocker, unless required
Reduce the number of users that have administrator privileges
Implement network segmentation, security zones, and firewall policies that limit how devices can communicate
PsExec is a Windows Sysinternals utility that enables IT administrators to run commands and executable binary files on remote servers, but it can also be used for stealthy lateral movement.
Network analysis and visibility solutions remain underrepresented in enterprises. Find out why in this preview of a new Wave report.
ExtraHop® Named a Leader in First-Ever Gartner® Magic Quadrant™ for Network Detection and Response
Visit this resource for more information.
This analysis exposes the critical link between an organization's lack of internal visibility and the escalating cost of compromise, demanding an urgent re-evaluation of how core business assets are protected.
Learn why you need to be wary of the claims certain network detection and response providers make about their coverage against the MITRE ATT&CK framework.
Learn how NDR from RevealX helps security teams detect and investigate more adversary TTPs in the MITRE ATT&CK framework than rule-based tools.
