MexicanMafia Impacket Suite Lateral Movement - Operation Escaneo
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution, as observed in Operation Escaneo attributed to MexicanMafia targeting LatAm critical infrastructure. The rule identifies Impacket activity through process command lines, service installations, and network connections to SMB (port 445) and DCOM (port 135) from Python or Impacket-related executables.
Microsoft Sentinel (KQL)
