APT36 IPC$ null session and credentialed SMB lateral movement

Ibrahim Saud@tektrix

•updated Sep 20, 2026•0•0•5

Detects the use of the Windows 'net.exe' utility to establish an IPC$ null session or an authenticated connection to the IPC$ share. These techniques are often used by attackers to perform remote service discovery, interact with remote shares, or facilitate lateral movement within a network.