Impacket Lateral Movement Activity Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•4•0•52

Detects lateral movement activity using various Impacket tools such as wmiexec, dcomexec, atexec, and smbexec. The rule identifies specific parent processes and command-line arguments indicative of these tools, which often involve `cmd.exe` executing commands with output redirection to a local loopback address.