QEMU VM Lateral Movement via Impacket/NetExec SMB Logon Patterns

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

This rule detects potential lateral movement activities by monitoring Windows Event Logs for suspicious network logons combined with service installations typical of post-exploitation tools like Impacket (psexec.py, wmiexec.py, smbexec.py). It flags service names and paths that match known tool patterns, specifically looking for high-frequency lateral movement attempts within a 30-minute window, including specific command-line indicators in service image paths.