Signature Detail
Short Name |
SMB:TOOLS:PSEXEC |
|---|---|
Severity |
Medium |
Recommended |
No |
Category |
SMB |
Keywords |
SMB psexec |
Release Date |
2003/04/22 |
Update Number |
1213 |
Supported Platforms |
di-5.3+, idp-4.0+, isg-3.0+, j-series-9.5+, mx-9.4+, srx-9.2+, srx-branch-9.4+, vsrx-12.1+ |
SMB: PSEXEC Tool Detected
This signature detects attempts to upload psexec.exe, an SMB tool for uploading and executing programs interactively. This signature also can detect that the psexec.exe has already logged into the system; Psexec.exe can upload itself to the host only after successful login. Worms often use psexec.exe to propagate.
Extended Description
PsExec is a telnet-like administration software that takes advantage of Windows NT/2000 features. It could also be used as a hacking tool.