Impacket Portable Bundle AD Enumeration and Lateral Movement via SMB

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•5

This rule detects the execution of Impacket toolkit modules (such as psexec.py, wmiexec.py, secretsdump.py) via EDR process events, as well as potential lateral movement patterns identified by NTLM authentication (Logon Type 3) to ADMIN$ or IPC$ shares. This combination of signals is indicative of credential dumping, remote service execution, or lateral movement using techniques often employed by the Impacket suite.