New Metasploit Modules: Peyara Remote Mouse RCE and SMB Session Upgrades

This week’s Metasploit Framework update introduces capabilities that significantly lower the barrier for post-exploitation lateral movement and remote code execution (RCE). As of July 2026, Rapid7 contributor Dean Welch has released the windows/manage/smb_to_meterpreter module, designed to automate the upgrade of basic SMB command sessions into full-featured Meterpreter payloads. Simultaneously, a new module targeting the Peyara Remote Mouse software (v1.0.1) exposes a critical unauthenticated RCE vulnerability.

For defenders, this update signals an immediate need to inventory software assets and tighten controls around SMB lateral movement. The automation of session upgrades and the availability of easy-to-use exploits for peripheral software dramatically increase the speed at which attackers can pivot from initial access to full domain compromise.

Technical Analysis

1. SMB to Meterpreter Session Upgrade

• Module Path: windows/manage/smb_to_meterpreter
• Contributor: Dean Welch

This module streamlines a common attacker workflow: gaining a foothold via an SMB session (e.g., through psexec or SMB credential theft) and upgrading that limited shell to a powerful Meterpreter session. Previously, this required manual file transfer and execution. Now, the module leverages PsExec functionality to inject the Meterpreter payload directly into the target session.

• Attack Vector: The module executes on the attacker's machine, targeting an active session ID. It utilizes the SMB protocol to facilitate the injection, effectively treating the established session as a transport for the upgrade.
• Risk: Automated privilege escalation and lateral movement. Attackers can rapidly transition from low-privilege command shell access to full Meterpreter capabilities (including hash dumping, Mimikatz loading, and pivot setup).

2. Peyara Remote Mouse Unauthenticated RCE

• Module Path: windows/misc/peyara_remote_mouse_rce
• Affected Product: Peyara Remote Mouse 1.0.1

A new module has been added to exploit a critical security issue in Peyara Remote Mouse. This software, often used for remote PC control, contains a flaw that allows unauthenticated, remote code execution. The module author notes that this vulnerability does not require valid credentials to trigger.

• Attack Vector: An attacker on the same network (or exposed to the internet if misconfigured) can send a malicious payload to the listening service of Peyara Remote Mouse.
• Risk: Complete system compromise. Since this is an unauthenticated RCE, it serves as a prime initial access vector, allowing attackers to gain SYSTEM-level privileges without user interaction.
• Exploitation Status: A Metasploit module is now available, moving this vulnerability from theoretical concern to active exploit risk.

Detection & Response

Sigma Rules

Detecting the SMB-to-Meterpreter upgrade requires monitoring for the specific behaviors associated with PsExec usage (service creation) and the abnormal execution of Peyara Remote Mouse.

---
title: PsExec Service Installation - Potential Lateral Movement
id: 8e45b7a1-2c1f-4a4e-9b3a-1d4f5e6a7b8c
status: experimental
description: Detects the installation of the PSEXESVC service, which is indicative of PsExec usage or the new SMB-to-Meterpreter upgrade module activity.
references:
 - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-07-03-2026/
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  product: windows
  service: security
detection:
  selection:
    EventID: 4697
    ServiceFileName|contains: 'PSEXESVC.exe'
  condition: selection
falsepositives:
  - Legitimate administrative usage of PsExec by IT staff
level: high
---
title: Peyara Remote Mouse Spawning Shell
id: 9f56c8b2-3d2e-5b5f-0c4b-2e5f6a7b8c9d
status: experimental
description: Detects the Peyara Remote Mouse application spawning a command shell or PowerShell, indicative of RCE exploitation.
references:
 - https://www.rapid7.com/blog/post/pt-metasploit-wrap-up-07-03-2026/
author: Security Arsenal
date: 2026/07/08
tags:
  - attack.initial_access
  - attack.t1190
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|contains:
      - 'RemoteMouse.exe'
      - 'Peyara.exe'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
  condition: all of selection_*
falsepositives:
  - Unknown (Administrative use of this software to launch scripts should be rare)
level: critical

KQL (Microsoft Sentinel / Defender)

// Hunt for PsExec service installation and suspicious Peyara activity
DeviceProcessEvents
| where (InitiatingProcessFileName =~ "services.exe" and FileName =~ "PSEXESVC.exe")
    or (InitiatingProcessFileName has "RemoteMouse" and (FileName has "cmd.exe" or FileName has "powershell.exe"))
| project Timestamp, DeviceName, InitiatingProcessFileName, FileName, ProcessCommandLine, AccountName
| order by Timestamp desc

Velociraptor VQL

-- Hunt for Peyara Remote Mouse installations and check for suspicious child processes
SELECT
    Pid,
    Name,
    CommandLine,
    Exe,
    Username,
    CreateTime
FROM pslist()
WHERE Name =~ "RemoteMouse" OR Name =~ "Peyara"

-- Check for recent PsExec service creation artifacts in registry
SELECT
    FullPath,
    Mtime,
    Data.value
FROM glob(globs="C:\\Windows\\System32\\config\\SYSTEM")
WHERE FullPath =~ "SYSTEM"

Remediation Script (PowerShell)

# Audit and Detection Script for Peyara Remote Mouse and PsExec Services

Write-Host "Checking for Peyara Remote Mouse installation..."
$peyara = Get-WmiObject -Class Win32_Product | Where-Object { $_.Name -like "*Remote Mouse*" -or $_.Name -like "*Peyara*" }
if ($peyara) {
    Write-Host "[ALERT] Peyara Remote Mouse found: $($peyara.Name) - Version: $($peyara.Version)" -ForegroundColor Red
    Write-Host "Action Required: Uninstall immediately or patch to the latest version." -ForegroundColor Yellow
} else {
    Write-Host "[OK] No Peyara Remote Mouse installation detected." -ForegroundColor Green
}

Write-Host "`nChecking for PsExec Service (PSEXESVC)..."
$service = Get-Service -Name PSEXESVC -ErrorAction SilentlyContinue
if ($service) {
    Write-Host "[ALERT] PSEXESVC service detected (Status: $($service.Status))." -ForegroundColor Red
    Write-Host "Action Required: Investigate source immediately. Stop and disable service if not authorized." -ForegroundColor Yellow
} else {
    Write-Host "[OK] PSEXESVC service not found." -ForegroundColor Green
}

Write-Host "`nAudit complete."

Remediation

Peyara Remote Mouse (Unauthenticated RCE)

1. Identify Assets: Immediately scan your environment for installations of "Peyara Remote Mouse". Use the provided PowerShell script or your EDR query capabilities.
2. Update or Uninstall: Check the vendor's official website for a patch addressing the unauthenticated code execution flaw. If no patch is available, uninstall the software immediately from all endpoints.
3. Network Segmentation: If removal is temporarily impossible, ensure that the devices running this software are isolated behind firewalls and cannot accept inbound connections from untrusted networks.

SMB to Meterpreter Upgrade

1. Restrict PsExec: The new module relies on PsExec-like behavior. Create Group Policy Objects (GPOs) to restrict the usage of PsExec and similar remote administration tools to only authorized admin workstations.
2. Disable Unused SMB Services: Ensure that Server Message Block (SMBv1) is disabled, and restrict SMB outbound traffic from critical assets to only necessary file servers using network segmentation or host-based firewalls.
3. Session Hygiene: Monitor for long-lived SMB sessions. Encourage frequent credential rotation and the use of Just-in-Time (JIT) access to limit the window attackers have to upgrade sessions.

Related Resources

Security Arsenal Penetration Testing Services AlertMonitor Platform Book a SOC Assessment vulnerability-management Intel Hub