CVE-2026-24294 Impacket NTLM Relay/SMB Server Tool Execution via Sysmon

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•0

This rule detects the execution of common Impacket toolkit utilities, such as ntlmrelayx.py and smbserver.py, via process command line arguments. These tools are frequently used by adversaries for relay attacks, remote service execution, and credential harvesting.