Impacket Detection Guide: Spotting Remote Execution, Credential Dumping and Relay

Impacket lets anyone with a valid password, hash or Kerberos ticket run commands, dump credentials and relay authentication against Windows hosts from a Linux machine, using nothing but the protocols Windows already speaks. It is an open source Python library, maintained by Fortra's Core Security, whose example scripts (wmiexec, smbexec, psexec, atexec, dcomexec, secretsdump, ntlmrelayx, GetUserSPNs and others) appear in penetration tests, ransomware intrusions and state-sponsored campaigns alike. This guide explains what each family of Impacket scripts leaves in Windows and domain controller telemetry, which detections survive the tool's changing defaults, and which hardening steps remove the preconditions. It is written for detection engineers, SOC analysts and Active Directory administrators.

This is an independent guide from NHI Mgmt Group, based on Impacket's public documentation and source as of November 2026. It is not sponsored or reviewed by Fortra or the Impacket maintainers, and it covers detection only.

Key takeaways

• Detect the target-side outcome, not the tool. Impacket runs on the attacker's host, so the durable signals are a network logon followed by a new service, scheduled task or a cmd.exe child of WmiPrvSE.exe on the target.
• Defaults drift, so treat string matches as a bonus. Current smbexec uses a random eight-letter service name and a randomised output file, while older public rules still look for fixed names; behavioural rules keep working when defaults change.
• Output redirection is the giveaway for the exec scripts. wmiexec, smbexec and dcomexec redirect command output to a file on ADMIN$ or C$ and read it back over SMB, which produces a distinctive cmd.exe command line and share access pattern.
• secretsdump and DCSync are identity events. Remote registry hive saves, volume shadow copies of NTDS.dit and directory replication requests from non-DC sources are the signals that matter, and every one should page someone.
• Hardening removes most of the toolkit's value. Unique local administrator passwords, SMB signing, NTLM restrictions, tiered administration and blocked workstation-to-workstation SMB, RPC and WMI make Impacket much less useful even before detection fires.

What Impacket is and why it is hard to see

MITRE ATT&CK tracks Impacket as software S0357 and describes it as an open source collection of Python modules for constructing and manipulating network protocols, with tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing and relay attacks. The project README lists implementations of SMB1 to SMB3, MSRPC over TCP, SMB and HTTP, plain, NTLM and Kerberos authentication using passwords, hashes, tickets or keys, and MSRPC interfaces including SAMR, LSAD, LSAT, NRPC, RRP, SCMR, TSCH, DCOM and WMI. The current release at the time of writing is v0.13.1, with v0.14.0 in development.

Three properties shape detection:

• Off-host execution: the scripts run on a Linux or Windows machine the attacker controls, often a jump host, a compromised appliance or a proxied tunnel. You will rarely find impacket on disk inside your estate.
• Legitimate protocols: SMB on TCP 445, RPC endpoint mapper on TCP 135 plus dynamic ports, DRSUAPI to domain controllers and Kerberos on TCP and UDP 88 are all normal traffic. The anomaly is who talks to whom, and what happens next.
• Credential material in any form: the scripts accept a password, an NT hash (pass the hash, T1550.002), an AES key or a Kerberos ccache (pass the ticket, T1550.003).

CISA advisory AA22-277A describes actors using wmiexec.py and smbexec.py to obtain semi-interactive shells on a defence industrial base network, then using compromised credentials to reach a more privileged service account.

Script families and the ATT&CK techniques they map to

Discovery scripts that enumerate users, groups, shares and trusts over SAMR, LSARPC and LDAP map to T1087.002, T1069.002, T1135 and T1482., and are useful mainly when correlated with the signals below.

Target-side signals for remote execution

All the execution scripts start with a network logon (Security event 4624, logon type 3) on the target. What follows differs by script, and that difference is what you detect. The Impacket source shows the mechanics: wmiexec names its output file __ followed by a Unix timestamp and defaults to the ADMIN$ share; smbexec builds an output file named __output_ plus eight random letters and, unless a name is supplied, a random eight-letter service name; atexec writes output to a random .tmp file under %windir%\Temp and registers a task with a random eight-letter name; psexec uses RemCom named pipes.

Public Sigma rules in the SigmaHQ repository encode most of these: "HackTool - Potential Impacket Lateral Movement Activity" (stable status) keys on the parent process plus the \\127.0.0.1\ redirect, "smbexec.py Service Installation" keys on the service image path, and "Impacket PsExec Execution" keys on the RemCom pipes. Note that the smbexec rule also matches an old fixed service name, BTOBTO; the current source generates a random name instead, which is exactly why the image path condition matters more than the name.

For WMI and service execution in general, see the T1047 Windows Management Instrumentation Defensive Guide and the MITRE ATT&CK T1021.002 Remote Services guide.

Credential dumping: secretsdump and DCSync

secretsdump has three modes, and each leaves a different trail. The source code is explicit about all three.

• Remote SAM and LSA secrets: the script starts the RemoteRegistry service if it is stopped, saves the SAM, SYSTEM and SECURITY hives to randomly named eight-letter .tmp files, reads them over ADMIN$ and deletes them. Look for event 7036 or 7040 for RemoteRegistry changing state, 5145 access to ADMIN$ with a relative target under SYSTEM32 ending in .tmp, and Sysmon 11 file creation of those files. SigmaHQ's "Possible Impacket SecretDump Remote Activity" rule uses the 5145 pattern.
• NTDS.dit through volume shadow copy: with -use-vss the script runs vssadmin create shadow remotely through its execution method, copies NTDS.dit from the shadow and then runs vssadmin delete shadows. On a domain controller, any vssadmin create or delete shadows command that is not your backup product is an incident. See the Credential Dumping Guide.
• DCSync over DRSUAPI: the default against a DC is to call DRSGetNCChanges, the same replication call domain controllers use with each other. On the DC this produces Security event 4662 (directory service access) with the control access rights DS-Replication-Get-Changes and DS-Replication-Get-Changes-All, by an account that is not a domain controller. Microsoft Defender for Identity raises "Suspected DCSync attack (replication of directory services)" (external ID 2006). See the Golden Ticket, Silver Ticket and DCSync Guide.

Event 4662 for DCSync only fires if the domain object has an auditing entry (SACL) for those rights and Directory Service Access auditing is enabled. Confirm that before you rely on it: an empty search proves nothing if the SACL is missing.

Relay and Kerberos scripts

ntlmrelayx does not execute anything on its own: it takes authentication coerced or poisoned from a victim and replays it to another service. The relay itself appears on the target as a 4624 logon with authentication package NTLM, from the IP address of the relay host rather than the victim's own address. Comparing the workstation name in the logon with the source IP is a practical hunt: a machine account authenticating from an address that does not belong to it is a strong relay indicator. Defender for Identity has related alerts including "Suspected NTLM authentication tampering" (2039) and "Suspected NTLM relay attack (Exchange account)" (2037). Prevention matters more than detection here; see the NTLM Relay Guide and the SMB Signing Guide.

The Kerberos scripts (GetUserSPNs, GetNPUsers, getST, ticketer) produce 4769 and 4768 events on domain controllers and are covered in depth elsewhere. See the Kerberoasting and AS-REP Roasting Defence Guide and the Pass-the-Hash and Pass-the-Ticket Guide.

Telemetry you need before any rule works

See the Windows Event Log Guide, the Sysmon Guide and the Active Directory Security Monitoring and Event IDs Guide for collection design.

Building and testing the detections

1. Confirm the telemetry: check that 4688 includes command lines, 5145 is enabled on servers, and the DCSync SACL exists. Forward everything to the SIEM; see the Windows Event Forwarding Guide.
2. Deploy behavioural rules first: cmd.exe or powershell.exe child of WmiPrvSE.exe with output redirection to a share; service image paths containing cmd.exe one-liners; tasks created and deleted within a short window; replication rights used by non-DC accounts.
3. Add string rules as a second layer: the SigmaHQ Impacket rules give quick coverage of default behaviour., tagged lower confidence.
4. Baseline legitimate tooling: configuration management, vulnerability scanners and backup agents use WMI, services and shadow copies. Record their accounts, source hosts and schedules, and exclude by that combination, never by process name alone.
5. Test in a lab or with an authorised red team: run each script once against a test host with written authorisation, confirm every rule fires, and keep the raw events as regression fixtures. See the ITDR validation guide.
6. Roll out in alert-only mode: run new rules in a non-paging queue for two to four weeks, tune the exclusions, then promote. Document exclusions so a rolled-back rule can return.

Hardening that removes the preconditions

• Unique local administrator passwords: pass the hash with a shared local administrator hash is the cheapest Impacket path. See the Local Administrator Password Solution (LAPS) Guide.
• Block lateral management ports: deny SMB 445, RPC 135 and dynamic RPC, and WinRM between workstations with host firewalls. Administration should come from defined management hosts only. See the Lateral Movement Guide.
• SMB signing and NTLM restrictions: require SMB signing and restrict NTLM so ntlmrelayx has nothing to relay to. See the NTLM Deprecation and Elimination Guide.
• Tiered administration: domain admin credentials should never touch workstations or member servers, so secretsdump against a server cannot harvest them. See the Privileged Access Workstations Guide.
• Limit replication rights: only domain controllers and a short, reviewed list of directory synchronisation accounts should hold replication rights. See the Active Directory ACL and Delegation Hygiene Guide.

Where identity fits

Impacket is an identity weapon: it does nothing without a credential. Service accounts are the usual prize, because they often hold local administrator rights on many servers, never log on interactively and have passwords that do not change. CISA's AA22-277A describes exactly this escalation from a compromised account to a higher-privileged service account. Directory synchronisation and hybrid identity servers hold credentials with replication or cloud administration rights, which is why credential theft from them reaches far beyond the host; the Storm-0501 hybrid cloud attacks show how stolen Entra Connect Sync credentials carried an on-premises intrusion into the cloud. Inventory these accounts, convert them to gMSA where possible and baseline where they log on from. See the service account inventory guide, the Group Managed Service Accounts (gMSA) Guide and the Service Account Behavioural Baselining Guide.

Decision guidance

Detection and measurement

• Telemetry coverage: percentage of servers sending 4688 with command lines and 5145; target 100% of tier 0 and tier 1.
• Rule validation rate: share of Impacket execution and dumping scripts that triggered at least one alert in the last authorised test; target every script in the families table.
• Time to triage: median minutes from a WmiPrvSE.exe or service-based execution alert to an analyst decision.
• Replication rights holders: count of non-DC principals with DS-Replication-Get-Changes-All; trend towards a short, reviewed list.
• Shared local administrator hashes: number of hosts sharing a local administrator password; target zero with LAPS.

Framework mapping

Common failure patterns

• Relying on tool names: rules matching BTOBTO or fixed output names miss current smbexec, which randomises both.
• Command line auditing off on servers: without it, a cmd.exe child of WmiPrvSE.exe is visible but the redirect that proves Impacket use is not.
• No SACL for replication rights: DCSync detection is configured in the SIEM but 4662 never fires because the domain root is not audited.
• Excluding by process name: excluding WmiPrvSE.exe children to quieten configuration management also hides wmiexec.
• Shared local administrator passwords left in place: detection fires on every host at once, by which time the attacker already has a domain foothold. The Cisco Active Directory credentials leak shows how long dumped hashes keep their value once they are out.

Practitioner checklist

• Enable process creation auditing with command lines, or Sysmon event 1, on every server and workstation.
• Enable Audit Detailed File Share (5145) on servers and domain controllers.
• Add a SACL for replication rights on the domain root and alert on 4662 replication by non-DC accounts.
• Deploy behavioural rules for WmiPrvSE.exe, mmc.exe and services.exe spawning cmd.exe with share redirection.
• Alert on any service image path containing cmd.exe one-liners and on tasks created and deleted within seconds.
• Alert on vssadmin shadow creation and RemoteRegistry start on domain controllers and tier 0 servers.
• Import the SigmaHQ Impacket rules as a second, lower-confidence layer.
• Deploy LAPS, require SMB signing and block workstation-to-workstation SMB and RPC.
• Test every rule against an authorised Impacket run and keep the events as regression fixtures.

Standards and references

• MITRE ATT&CK: Impacket (S0357)
• Fortra: Impacket project repository and README
• CISA: AA22-277A Impacket and Exfiltration Tool Used to Steal Sensitive Information from Defense Industrial Base Organization
• MITRE ATT&CK: OS Credential Dumping: DCSync (T1003.006)
• MITRE ATT&CK: Windows Management Instrumentation (T1047)
• Microsoft Learn: Microsoft Defender for Identity classic security alerts
• SigmaHQ: Sigma detection rule repository
• NIST: SP 800-53 Rev. 5

Related NHI Mgmt Group resources: Lateral Movement Guide · Credential Dumping Guide · Certipy and Certify AD CS Tooling Detection Guide · NetExec and CrackMapExec Detection Guide · Identity Threat Hunting Guide