diff --git a/atomics/T1035/T1035.md b/atomics/T1035/T1035.md
index 5ab1ee58..8f75b0e3 100644
--- a/atomics/T1035/T1035.md
+++ b/atomics/T1035/T1035.md
@@ -6,11 +6,13 @@
- [Atomic Test #1 - Execute a Command as a Service](#atomic-test-1---execute-a-command-as-a-service)
+- [Atomic Test #2 - Use PsExec to execute a command on a remote host](#atomic-test-2---use-psexec-to-execute-a-command-on-a-remote-host)
+
## Atomic Test #1 - Execute a Command as a Service
-Creates a service specifying an aribrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.
+Creates a service specifying an aribrary command and executes it. When executing commands such as PowerShell, the service will report that it did not start correctly even when code executes properly.
**Supported Platforms:** Windows
@@ -30,4 +32,31 @@ sc.exe delete #{service_name}
+
+
+
+## Atomic Test #2 - Use PsExec to execute a command on a remote host
+Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments
+Will run a command on a remote host
+
+**Supported Platforms:** Windows
+
+
+#### Inputs
+| Name | Description | Type | Default Value |
+|------|-------------|------|---------------|
+| psexec_path | Path to PsExec | string | C:\PSTools\PsExec.exe|
+| remote_host | Remote hostname or IP address | string | localhost|
+
+#### Run it with `powershell`!
+```
+#{psexec_path} \\#{remote_host} "C:\Windows\System32\calc.exe"
+```
+
+#### Commands to Check Prerequisites:
+```
+if(Test-Path #{psexec_path}) {0} else {1}
+```
+
+
diff --git a/atomics/index.md b/atomics/index.md
index e6da07a4..475276e9 100644
--- a/atomics/index.md
+++ b/atomics/index.md
@@ -772,6 +772,7 @@
- Atomic Test #2: Create and Execute Batch Script [windows]
- [T1035 Service Execution](./T1035/T1035.md)
- Atomic Test #1: Execute a Command as a Service [windows]
+ - Atomic Test #2: Use PsExec to execute a command on a remote host [windows]
- [T1218 Signed Binary Proxy Execution](./T1218/T1218.md)
- Atomic Test #1: mavinject - Inject DLL into running process [windows]
- Atomic Test #2: SyncAppvPublishingServer - Execute arbitrary PowerShell code [windows]
diff --git a/atomics/index.yaml b/atomics/index.yaml
index 4c7601bd..c10604d4 100644
--- a/atomics/index.yaml
+++ b/atomics/index.yaml
@@ -22332,9 +22332,11 @@ execution:
identifier: T1035
atomic_tests:
- name: Execute a Command as a Service
- description: "Creates a service specifying an aribrary command and executes
+ description: 'Creates a service specifying an aribrary command and executes
it. When executing commands such as PowerShell, the service will report that
- it did not start correctly even when code executes properly. \n"
+ it did not start correctly even when code executes properly.
+
+'
supported_platforms:
- windows
input_arguments:
@@ -22354,6 +22356,30 @@ execution:
sc.exe create #{service_name} binPath= #{executable_command}
sc.exe start #{service_name}
sc.exe delete #{service_name}
+ - name: Use PsExec to execute a command on a remote host
+ description: |
+ Requires having Sysinternals installed, path to sysinternals is one of the input input_arguments
+ Will run a command on a remote host
+ supported_platforms:
+ - windows
+ input_arguments:
+ psexec_path:
+ description: Path to PsExec
+ type: string
+ default: C:\PSTools\PsExec.exe
+ remote_host:
+ description: Remote hostname or IP address
+ type: string
+ default: localhost
+ executor:
+ name: powershell
+ elevation_required: false
+ prereq_command: 'if(Test-Path #{psexec_path}) {0} else {1}
+
+'
+ command: '#{psexec_path} \\#{remote_host} "C:\Windows\System32\calc.exe"
+
+'
T1218:
technique:
x_mitre_data_sources:
diff --git a/atomics/windows-index.md b/atomics/windows-index.md
index 35aca61d..2dc25b92 100644
--- a/atomics/windows-index.md
+++ b/atomics/windows-index.md
@@ -647,6 +647,7 @@
- Atomic Test #2: Create and Execute Batch Script [windows]
- [T1035 Service Execution](./T1035/T1035.md)
- Atomic Test #1: Execute a Command as a Service [windows]
+ - Atomic Test #2: Use PsExec to execute a command on a remote host [windows]
- [T1218 Signed Binary Proxy Execution](./T1218/T1218.md)
- Atomic Test #1: mavinject - Inject DLL into running process [windows]
- Atomic Test #2: SyncAppvPublishingServer - Execute arbitrary PowerShell code [windows]