Impacket SMB Pass-the-Hash Lateral Movement via psexec/wmiexec/smbexec

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•4

Detects evidence of common Impacket tool execution (e.g., psexec, wmiexec, smbexec, ntlmrelayx), unauthorized access to sensitive SMB administrative shares (ADMIN$, IPC$), creation of suspicious services often used for remote execution, and lateral movement via NTLM network logons.