Impacket Lateral Movement via SMB Named Pipes and Service Creation

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•2

This rule monitors for indicators of Impacket toolset usage across multiple data sources, including named pipe access (Event 5145), service creation (Event 7045), scheduled task creation (Event 4698), and process execution (Event 1). It flags suspicious activity associated with modules like secretsdump, wmiexec, psexec, and smbexec, aggregating findings by source host and user to evaluate the breadth of potential unauthorized activity.