NetExec and CrackMapExec Detection Guide

NetExec and its predecessor CrackMapExec let one operator test a single set of credentials against every Windows host in a network at once, so the first sign of an intruder is often hundreds of SMB, LDAP or WinRM logons in a few minutes from one machine. Both tools are built for authorised penetration testing of Active Directory networks, and both appear in government and incident response reporting on real intrusions. This guide explains what the tools do in ATT&CK terms, the Windows and network telemetry they leave, how to tell an approved test from an attack, and the identity hardening that makes their output far less useful. It is for SOC analysts, detection engineers, Active Directory administrators and identity teams, and it is defensive only: no commands or attack procedures. For the wider technique, see the Lateral Movement Guide; this page goes deeper on one tool family.

This is an independent guide from NHI Mgmt Group, based on NetExec's public documentation as of November 2026. It is not sponsored or reviewed by the NetExec maintainers. Tool features change, so confirm behaviour against the current documentation.

Key takeaways

One name change, the same behaviour. NetExec (command name nxc) is the community continuation of CrackMapExec, renamed in 2023, so detections written for CrackMapExec (ATT&CK S0488) largely carry over.
Volume and fan-out are the signal. The tool's value to an attacker is breadth: one source authenticating to many hosts over SMB, LDAP, WinRM, MSSQL or RDP in a short window, which is easy to see if you collect logon events from member servers and workstations.
Every useful result needs a credential. Spraying, pass the hash, SAM and LSA secret dumps and remote execution all depend on reusable passwords, shared local administrator accounts and over-privileged service accounts.
Hardening shrinks the output. Windows LAPS, restricted remote SAM calls, SMB signing, NTLM reduction and tiered administration turn a network-wide sweep into a list of failed logons.
Register authorised tests. The same tool runs in your red team engagement, so detection only works alongside a register of approved test sources, accounts and windows.

What NetExec and CrackMapExec are

CrackMapExec was created in 2015 and maintained by the community until September 2023, when its maintainer retired. The remaining contributors continued development as a fully free and open source project under the new name NetExec, published under the BSD-2-Clause licence on GitHub (Pennyw0rth/NetExec). The project describes itself as a network service exploitation tool that helps automate assessing the security of large networks. MITRE ATT&CK v20 profiles CrackMapExec as software S0488: a post-exploitation tool written in Python, designed for penetration testing, that collects Active Directory information to support lateral movement.

Item	Detail	Why defenders care
CrackMapExec (CME), ATT&CK S0488	Original project, 2015 to 2023; older copies remain in circulation	Existing threat intelligence, groups and detections reference this name
NetExec (nxc)	Community continuation from 2023, BSD-2-Clause	Current releases add protocols and modules; behaviour on the wire is similar
Protocols	SMB, LDAP, WinRM, MSSQL, SSH, FTP, RDP, WMI, NFS and VNC (per the project wiki)	Logon telemetry is spread across domain controllers, member servers and SQL hosts
Remote execution over SMB	wmiexec, then atexec, then smbexec, falling back in that order; all need administrator credentials on the target	Each method leaves a different process, task or service trace
Local database	Per-protocol databases and workspaces under ~/.nxc/workspaces, holding hosts, shares and every used or dumped credential	An operator's machine, or a forgotten test laptop, holds harvested credentials

ATT&CK links CrackMapExec to APT39, Dragonfly, Ember Bear, FIN7 and MuddyWater, and to the Cutting Edge campaign against Ivanti Connect Secure appliances. The joint advisory AA24-249A on GRU Unit 29155 (Ember Bear, also tracked as Cadet Blizzard) lists CrackMapExec next to Impacket, Metasploit, BloodHound and Responder in the actors' toolset. Google Threat Intelligence reporting on Ivanti exploitation in early 2024 also named CrackMapExec among post-exploitation tools, a case covered in the Ivanti Connect Secure Exploitation 2024 breach analysis. See the Cadet Blizzard Threat Actor Profile Guide.

What the tools do in ATT&CK terms

The table lists the ATT&CK v20 techniques mapped to S0488, grouped by what a defender sees. NetExec adds protocols and modules beyond this list, so treat it as a floor, not a ceiling.

Tactic	Technique (ID)	What the tool does (per ATT&CK)	Primary telemetry
Credential access	Password Guessing (T1110.001), Password Spraying (T1110.003), Brute Force (T1110)	Tries one or many passwords across users and hosts in a network range	4625 and 4771 failures, 4776 on DCs, lockout events 4740
Discovery	Password Policy Discovery (T1201)	Reads the lockout threshold so spraying stays below it	SAMR and LDAP queries from a non-admin host
Discovery	Domain Account (T1087.002), Domain Groups (T1069.002), Network Share Discovery (T1135), Remote System Discovery (T1018), System Network Connections Discovery (T1049)	Enumerates users, group members, shares and permissions, live hosts and sessions	5140 and 5145 share access, SAMR audit events, LDAP query volume
Lateral movement	Pass the Hash (T1550.002)	Authenticates over SMB with an NTLM hash instead of a password	4624 logon type 3 with NTLM package, 4776
Credential access	Security Account Manager (T1003.002), LSA Secrets (T1003.004), NTDS (T1003.003)	Dumps local SAM hashes and LSA secrets remotely; replicates domain hashes through directory replication	Remote registry access, 4662 replication rights on DCs, Defender for Identity alerts
Execution	Windows Management Instrumentation (T1047), PowerShell (T1059.001), At (T1053.002)	Runs remote commands through WMI, PowerShell via WMI and scheduled tasks	4688 with WmiPrvSE.exe as parent, 4698 task creation, 4104 script blocks
Persistence, defence impairment	Modify Registry (T1112)	Can create the WDigest registry value so cleartext credentials are cached at next logon	Registry auditing (4657) or Sysmon 13 on the WDigest key

The mapping makes the point that this is an identity tool as much as a network tool: almost every row either uses a credential or produces one. See the Password Spraying and Credential Stuffing Defence Guide and the Pass-the-Hash and Pass-the-Ticket Guide.

Detection: the telemetry that matters

Windows event logs

Event ID	Log and where to collect	Pattern to look for	False positive notes
4625, 4771, 4776	Security; member servers and workstations (4625), domain controllers (4771 Kerberos pre-authentication failure, 4776 NTLM validation)	One source address failing against many accounts or many hosts within minutes; the same password tried once per user	Vulnerability scanners with stale credentials; fix them rather than suppress
4624 type 3	Security; all hosts	One account with network logons to tens of hosts in a short window, Authentication Package NTLM where Kerberos is normal, or a local account logging on from another workstation	Software deployment and inventory servers; allowlist by source host
5140, 5145	Security (file share auditing); servers	ADMIN$, C$ and IPC$ access from workstations, rapid enumeration of every share on a host	Backup and management tools; baseline by source
4688 or Sysmon 1	Security with command line, or Sysmon; all hosts	cmd.exe or powershell.exe spawned by WmiPrvSE.exe, taskeng or svchost hosting the Schedule service, followed by output written to a temporary file or share	Configuration management tools use WMI; check signer and command line
4698, 7045, 4697	Security and System; all hosts	Short-lived scheduled tasks or services with random names created remotely and deleted within seconds	Patch tools create tasks and services, but with stable names
16968, 16965	System (Directory-Service-SAM)	Remote SAM enumeration that the RestrictRemoteSam policy would deny (audit mode) or has denied	Legitimate admin scripts appear during audit; build the allow list from them

See the Active Directory Security Monitoring and Event IDs Guide and the Sysmon Guide for collection settings.

Identity threat detection

Where you run Microsoft Defender for Identity, its classic alert set covers several of the tool's behaviours: Account Enumeration reconnaissance (LDAP, external ID 2437), User and Group membership reconnaissance (SAMR, 2021), Suspected Brute Force attack (SMB, 2033, which the documentation maps to password spraying T1110.003), Suspected brute force attack (Kerberos, NTLM, 2023), Suspected identity theft (pass-the-hash, 2017), Remote code execution attempt (2019), Suspicious service creation (2026) and Suspected DCSync attack (replication of directory services, 2006). Other identity threat detection products have equivalent detections under different names. Validate that they fire on a controlled test before relying on them. See the Microsoft Defender for Identity guide and the ITDR validation guide.

Network signals

Fan-out: one internal host opening TCP 445 (SMB), 389 or 636 (LDAP), 5985 or 5986 (WinRM), 1433 (MSSQL) or 3389 (RDP) sessions to a large share of a subnet in minutes. Workstation-to-workstation SMB is rare in most estates and is a strong signal on its own. MITRE D3FEND calls this Administrative Network Activity Analysis (D3-ANAA).
Short SMB sessions: negotiate, authenticate, query and close, repeated across hosts, with very little data transferred.
Source context: sweeps from a VPN pool address, a Linux host in a Windows server subnet, or a newly seen device deserve faster triage than sweeps from a known management server.

See the NDR Guide.

Telling a test from an attack

Keep a register of approved engagements with source addresses, test accounts, time windows and scope, and give the SOC access before testing starts. Alert on the behaviour regardless, then close it against the register, never suppress it in advance. An approved test that the SOC did not see is a detection gap worth recording. See the Red Team Rules of Engagement Template.

Prevention: making the sweep return nothing

Tool behaviour	Control	Setting or mechanism	Effect
Password spraying	Account lockout tuned with smart lockout or ITDR, banned password lists, phishing-resistant MFA on remote access	Default Domain Policy or fine-grained password policies; see the lockout guide	Common passwords stop working; sprays generate alerts before success
Pass the hash with a local administrator	Windows LAPS	Unique, rotated local administrator password per device	A hash from one host does not work on the next
Remote SAM and user enumeration	Network access: Restrict clients allowed to make remote calls to SAM	Registry value RestrictRemoteSam under HKLM\System\CurrentControlSet\Control\Lsa; audit first with RestrictRemoteSamAuditOnlyMode = 1	Only approved accounts can enumerate SAM over SAMRPC
Relay and session tampering	SMB signing and LDAP signing with channel binding	Required by default for inbound and outbound SMB on Windows 11 24H2 Enterprise, Pro and Education; outbound on Windows Server 2025; set by policy on older versions	Captured authentication cannot be relayed to signed services
NTLM use generally	Restrict NTLM, starting with audit	Network security: Restrict NTLM policies and the NTLM operational log	Removes the protocol that pass the hash depends on
Remote execution with admin rights	Tiered administration, privileged access workstations, host firewall rules for WMI, WinRM and SMB from approved admin sources only	Windows Defender Firewall inbound rules scoped by source address	Admin credentials are not exposed on, or usable from, ordinary hosts
WDigest cleartext caching	Keep WDigest credential caching off and monitor the registry value	UseLogonCredential under the WDigest provider key	Cleartext passwords are not held in memory
Domain hash replication	Restrict replication rights to domain controllers; monitor 4662 for replication GUIDs from non-DCs	Review of Replicating Directory Changes All holders	Only DCs can request password data

The SMB signing defaults are from Microsoft's documentation for Windows 11 24H2 and Windows Server 2025. See the SMB Signing Guide, the Local Administrator Password Solution (LAPS) Guide, the NTLM Deprecation and Elimination Guide and the Account Lockout and Brute-Force Protection Guide.

Where identity fits

These tools work on credentials, and machine and service credentials are often the most valuable ones they find. A service account that logs on to many servers, with a password that has not changed in years and membership of a local Administrators group everywhere, gives one compromised host a path to all of them. LSA secrets dumped from a server often include service account passwords in recoverable form, because Windows needs them to start the service.

Service accounts: move to group managed service accounts where the application supports them, and remove interactive and network logon rights from accounts that do not need them. See the Group Managed Service Accounts (gMSA) Guide.
Scanner and deployment accounts: vulnerability scanners and software deployment tools use privileged accounts that touch every host, which is the same pattern as a sweep. Give them their own tier, restrict their source hosts and alert when they log on from anywhere else.
Honeytokens: decoy accounts and stale-looking credentials placed where enumeration will find them give a high-confidence alert when used. See the Honeytokens and Canary Credentials Guide.

Implementation: a phased approach

Collect first (weeks 1 to 2). Forward 4624, 4625, 4688 with command line, 4698, 4697, 5140, 5145 and 7045 from member servers and a sample of workstations, plus 4662, 4771 and 4776 from domain controllers. Many estates only collect from DCs and miss the fan-out entirely.
Write fan-out analytics (weeks 2 to 4). Count distinct destination hosts per source and per account in five and sixty minute windows. Set thresholds from a two-week baseline, with named exceptions for management servers.
Audit the hardening (weeks 2 to 6). Turn on RestrictRemoteSam audit-only mode, NTLM auditing and SMB signing auditing. Review the events to find the applications that would break.
Enforce in rings (weeks 6 to 12). Deploy Windows LAPS, enforce RestrictRemoteSam and SMB signing, and scope WMI and WinRM firewall rules, first on a pilot group of workstations, then servers, then the rest. Roll back by reverting the policy to audit for the affected ring, not by removing it estate-wide.
Test with an approved run. Have the red team or a purple team run NetExec within a registered window and confirm each detection and preventive control works. See the Purple Teaming Guide.
Prepare the response. On an unregistered sweep: isolate the source host, identify the account used, reset that credential and any credential the tool could have dumped from hosts where it had admin rights, and hunt for follow-on activity such as new services and remote tasks.

Decision guidance

Small organisations with a managed detection service should confirm three things: that workstation and server logons, not just DC logons, are collected; that the provider alerts on many-host SMB logons from one source; and that Windows LAPS is deployed. These three cover most of the risk.
Larger estates should add identity threat detection on domain controllers, network fan-out analytics, enforced RestrictRemoteSam and a tiering model so that admin accounts never authenticate to lower-tier hosts.
Prevent or detect first? If you cannot yet collect workstation events, start with LAPS and SMB signing, because they reduce what an attacker gains without new data pipelines. If you already have good telemetry, start with detection so you can measure exposure before enforcement breaks anything.
Block the tool or the behaviour? Hash and name based blocking of NetExec binaries is of limited value: the tool runs from the attacker's own machine, often a Linux host, and never needs to touch disk on your endpoints. Defend the protocols and the credentials instead.

Metrics that show it is working

Logon telemetry coverage: percentage of Windows servers and workstations forwarding 4624 and 4625 to the SIEM (target 95% or more).
Purple team detection rate: share of NetExec test actions (spray, enumeration, remote execution, SAM dump) that alerted within 15 minutes.
LAPS coverage: percentage of Windows devices with a unique, managed local administrator password.
SAM enumeration exposure: number of hosts without an enforced RestrictRemoteSam policy.
NTLM share: percentage of network logons using NTLM, tracked monthly toward a reduction target.
Service account sprawl: number of service accounts with local administrator rights on more than ten hosts.

Common failure patterns

Collecting only from domain controllers. A pass the hash sweep with a local administrator account never touches a DC, so the only evidence sits on the targets.
One local administrator password everywhere. A single SAM dump then unlocks the whole estate, which is the outcome the tool is designed to find quickly.
Suppressing scanner noise permanently. When a vulnerability scanner's failed logons are excluded by source address, an attacker on that host, or one spoofing its pattern, is excluded too.
Treating approved tests as background. Teams that whitelist red team sources in advance never learn whether the detections work.
Edge device to internal sweep. In the Ivanti Connect Secure Exploitation 2024 case, credentials harvested at the VPN were used with internal tooling. Treat sweeps from VPN pools as high priority and reset credentials that passed through a compromised appliance.

Framework mapping

Framework	Reference	Relevance
MITRE ATT&CK v20	S0488; T1110.003, T1550.002, T1003.002, T1003.004, T1003.003, T1047, T1135, T1201	Tool profile and the techniques to detect
MITRE D3FEND	D3-ANAA Administrative Network Activity Analysis, D3-AZET Authorization Event Thresholding, D3-AL Account Locking, D3-CRO Credential Rotation, D3-UAP User Account Permissions	Fan-out detection, failed logon thresholds, lockout, LAPS-style rotation, least privilege
NIST CSF 2.0	DE.CM-01, DE.CM-03, DE.AE-02, PR.AA-01, PR.AA-05	Network and personnel activity monitoring, event analysis, credential management, least privilege
NIST SP 800-53 Rev. 5	AC-7, AC-6, AC-17, IA-5, SI-4, AU-6, AU-12, IR-4	Failed logons, least privilege, remote access, authenticators, monitoring, log review and generation, incident handling
CIS Controls v8.1	5 Account Management, 6 Access Control Management, 8 Audit Log Management, 13 Network Monitoring and Defense	Account hygiene, access control, logging and network monitoring

Practitioner checklist

Collect 4624, 4625, 4688, 4698, 5140, 5145 and 7045 from servers and workstations, not only from domain controllers.
Alert on one source or one account authenticating to many hosts over SMB, LDAP, WinRM, MSSQL or RDP in a short window.
Deploy Windows LAPS to every Windows device and confirm no shared local administrator password remains.
Run RestrictRemoteSam in audit-only mode, review events 16968, then enforce with an allow list.
Require SMB signing and LDAP signing, and audit then reduce NTLM.
Scope WMI, WinRM and SMB administration to approved admin hosts with host firewall rules.
Move service accounts to gMSA and remove local admin rights they do not need.
Keep an authorised test register and run a NetExec purple team exercise at least yearly.

NetExec and CrackMapExec Detection Guide: Spotting Network-Wide Credential Abuse Early