{
  "family": "winexe",
  "sample_count": 2,
  "category": "advanced_threat",
  "description": "HackTool:Win32/Winexe (or simply `winexe`) is a legitimate, open-source GNU/Linux utility that allows users to execute commands remotely on Windows operating systems from a GNU/Linux host. It functions similarly to Microsoft's Sysinternals PsExec. However, because it facilitates remote execution, it is heavily weaponized by threat actors (particularly those operating from Linux-based C2 infrastructure or Kali Linux pivot machines) to achieve lateral movement and Remote Code Execution (RCE) on Windows targets (`T1569.002`).<br><br><b>Understanding Winexe (Living off the Land)</b><br>To an end-user, `winexe` execution is invisible. For a security operations center, the detection of `winexe` activity is a critical incident indicating that an attacker has compromised credentials and is actively moving laterally across the network from a Linux-based platform. Because the underlying protocols (SMB/RPC) are legitimate, distinguishing malicious `winexe` use from legitimate administration (if Linux admins manage Windows boxes) requires deep behavioral analysis.<br><br><b>Execution and Lateral Movement Mechanics</b><br>An attacker requires valid Windows credentials (or a password hash for Pass-the-Hash attacks) and network access to the target's SMB ports (TCP 139/445). From their Linux machine, they run a command like `winexe -U DOMAIN/Admin%Password //192.168.1.10 'cmd.exe'`. Winexe connects to the Windows target via SMB (`T1021.002`), authenticates, accesses the hidden `ADMIN$` share, and drops a small service executable (typically named `winexesvc.exe`). It creates and starts a Windows Service to run this executable (`T1543.003`), which then executes the requested command (e.g., `cmd.exe`) and pipes the output back to the Linux attacker over a named pipe.<br><br><b>Indicators of Compromise & Impact</b><br>The impact is total control over the targeted Windows host. Host-based IoCs are highly specific: EDR alerts for the creation and execution of the `winexesvc.exe` service (often running from `%SystemRoot%`), and Windows Event Log 7045 (A service was installed in the system) detailing the `winexesvc` installation. Network IoCs include inbound SMB traffic (TCP 445) originating from unusual Linux hosts (or VPN endpoints) followed immediately by RPC traffic and named pipe communication.",
  "cta": "Published by the SystemHelpdesk team.",
  "aliases": [],
  "enrichment_level": "expert-seo",
  "faq": [],
  "faq_count": 0,
  "mitre_attack": [
    "T1543.003",
    "T1021.002",
    "T1569.002"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-06-09",
  "mitre_attack_detail": [
    {
      "id": "T1569.002",
      "name": "System Services: Service Execution (Abusing Windows Services to execute commands remotely)",
      "tactic": "Execution"
    },
    {
      "id": "T1021.002",
      "name": "Remote Services: SMB/Windows Admin Shares (Using SMB and ADMIN$ for lateral movement)",
      "tactic": "Lateral Movement"
    },
    {
      "id": "T1543.003",
      "name": "Create or Modify System Process: Windows Service (Creating the winexesvc service)",
      "tactic": "Persistence"
    }
  ],
  "containment_steps": [
    "Isolate the targeted Windows machine and, crucially, identify and isolate the Linux host from which the `winexe` command originated.",
    "Assume the credentials used by `winexe` are fully compromised and initiate an immediate, enterprise-wide password reset for that account.",
    "Use EDR to hunt across the network for the presence of `winexesvc.exe` or Event ID 7045 related to `winexe` to map the extent of lateral movement.",
    "Restrict SMB (TCP 445) communication between workstations; SMB should generally only flow between workstations and designated file servers/domain controllers."
  ],
  "what_to_avoid": [
    "Do not ignore `winexesvc.exe` detections assuming they are benign administrative activity unless you explicitly use Linux to manage Windows hosts in your environment.",
    "Avoid leaving the `ADMIN$` share enabled if it is not strictly required for centralized management tools."
  ],
  "target_industries": [
    "Global / Opportunistic"
  ],
  "motivation": "Opportunistic",
  "threat_actors": [
    "Unknown / Cybercriminal"
  ],
  "target_geographies": [
    "Global"
  ]
}