Impacket mini_imp SMB Lateral Movement, Credential Dumping, and NTLM Relay

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•6

Detects the execution of known Impacket framework scripts such as psexec.py, wmiexec.py, and secretsdump.py, or command lines containing common indicators associated with these tools. The rule monitors process start events and filters for indicators of lateral movement and credential harvesting including administrative share access and lsass or ntds.dit interaction.