NetExec/CrackMapExec lateral movement via SMB authentication sweeps

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•5

This rule monitors process execution events for the presence of known penetration testing and post-exploitation tools, specifically NetExec (formerly CrackMapExec), nxc, or cme. These tools are frequently used by adversaries for network discovery, lateral movement, and credential harvesting within Active Directory environments.