Impacket psexec/smbexec/wmiexec SMB Lateral Movement Detection

Ibrahim Saud@tektrix

•updated Jun 25, 2026•1•0•6

This rule detects lateral movement activity associated with the Impacket toolkit. It monitors for the execution of common Impacket scripts (e.g., psexec.py, smbexec.py, wmiexec.py) or binaries (psexec.exe/PsExec64.exe) spawning from suspicious parent processes or interacting with sensitive Windows shares (ADMIN$, IPC$). Additionally, it flags Python processes performing SMB connections to multiple internal hosts, as well as cmd.exe/powershell.exe instances spawned from services.exe that reference Impacket tool names in their command lines.