Windows Server PAExec Tool Remote Shell

PAExec is a remote administration tool designed as an alternative to psexec. The tool is a small remote shell that includes functionality for copying files, remote execution, and fully interactive shell sessions with remote Windows machines without the need to install client software. The functionality offered by the PAExec tool is perfect for conducting Post Compromise activity once a foothold has been established.

Exploitation

Stages

1. An attacker compromises a Windows system and gains a foothold.
2. The attacker uses the PAExec tool to move laterally using compromised credentials.

Prerequisites

The attacker will compromise a Windows server and gain administrator credentials for the target system.

Alert Logic Coverage

Alert Logic® has evaluated its customer base for exposure to the exploit and has developed signatures for mitigating the threat depending on the security service in place.

The Network-Based Intrusion Detection System (IDS) has been updated with the new signatures for this exploit when detected via Alert Logic Threat Manager™. If this signature is detected, an incident is generated in the Alert Logic console.

Detection of this threat is provided via the Alert Logic ActiveWatch for Log Manager™ service. Log messages are produced by the vulnerable system when an exploit of this type is leveraged. An incident will be generated in the Alert Logic console if these log messages are observed.

Recommendations for Mitigation

The attacker must have exploited some other entry vector to gain access to the local victim host. Ensure that all software on internet-facing hosts is up-to-date.