Impacket credential harvesting and lateral movement tools detected on host

Ibrahim Saud@tektrix

•updated Jun 30, 2026•3•0•6

Detects the execution of known Impacket framework tools (such as secretsdump, wmiexec, smbexec, atexec, GetUserSPNs, or ntlmrelayx) which are commonly used for credential dumping, remote service execution, and lateral movement.