← All Chokepoints HIGH

Remote Execution Tools (HackTools)

Lateral Movement Execution T1021.002 T1021.003 T1021.006 T1047 T1053.005 T1569.002 Detection difficulty: MEDIUM Prevalence: HIGH

Offensive security tools (Impacket, NetExec, CrackMapExec, Evil-WinRM) used for remote code execution across Windows environments. These frameworks wrap legitimate Windows protocols (SMB, WMI, WinRM, RPC) to execute code on remote systems using valid admin credentials. Despite tool diversity, the chokepoint is invariant: valid admin credentials, network access to target ports, and a remote execution primitive (service creation, WMI process, scheduled task) are always required.

By @iimp0ster · Updated 2026-03-07 · View source YAML

Prerequisites (Environmental)

  • ✓ Network access to target on at least one required protocol port (SMB 445, WMI/RPC 135, WinRM 5985/5986)
  • ✓ Remote execution surface enabled on target (Server service for SMB, WinRM service, WMI, or Task Scheduler)

Variations

Tools and methods that exploit this chokepoint — the list grows; the chokepoint doesn't change:

Impacket Active
2015

Python suite with psexec/wmiexec/atexec/dcomexec modules; rdp_shadow added January 2025

Source →
CrackMapExec Archived
2016

Archived December 2023; superseded by NetExec — CME-specific signatures now stale

NetExec Active
2023

Active CrackMapExec fork; adds LDAP, SSH, and improved OPSEC features

Source →
Evil-WinRM Active
2019

Dedicated WinRM exploitation tool targeting port 5985/5986

Metasploit psexec Active
2007

Original PsExec-style SMB execution via Metasploit framework

Sliver Active
2020

Open-source C2 widely adopted by nation-state and ransomware actors as Cobalt Strike alternative

Havoc Active
2022

Modern C2 with strong EDR bypass features; uses same underlying Windows execution primitives

Detection Strategy

Build detections iteratively. Start broad to understand your baseline, then tighten to production-ready.

Goal: Identify network logon events followed by service creation or remote process execution

Log Sources

  • Windows Security Event ID 4624 (Successful Logon)
  • Windows Security Event ID 4688 (Process Creation)
  • Windows System Event ID 7045 (Service Installed)

FP Rate: High

Use Case: Baseline normal admin activity; understand legitimate remote administration patterns

Detection Logic

Event ID: 4624 LogonType: 3 (Network) Account: Member of local Administrators or Domain Admins Within 60 seconds: Service creation (7045) OR process creation with elevated token
Sigma Rule — Research Level
View on GitHub Download 
title: Network Logon Followed by Service Installation
id: e1f5a7b9-c1d3-4e5f-7a8b-9c0d1e2f3a4b
status: experimental
description: >
  Detects Windows network logon events (Type 3) followed closely by service installation
  events. Research-level rule for the remote execution tools chokepoint. This covers
  PsExec-style execution via Impacket, CrackMapExec, NetExec, and native PsExec.exe.
  High false positive rate expected — legitimate remote admin activity generates the
  same pattern. Use to baseline normal admin behavior.
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1021/006/
  - https://www.socinvestigation.com/threat-hunting-with-eventid-5145-object-access-detailed-file-share/
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.execution
  - detection.maturity.research
logsource:
  product: windows
  service: system
detection:
  selection:
    EventID: 7045
    # Any new service installation — extremely broad
  condition: selection
falsepositives:
  - Software installation via MSI packages
  - Windows Update installing drivers and services
  - Legitimate remote administration (SCCM, Ansible, PDQ Deploy)
  - IT staff using PsExec or similar tools for authorized administration
  - Antivirus/EDR product updates
level: informational

Goal: Network logon with suspicious service creation (random name or unusual path) or WMI parent process

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Windows Security Event ID 4624 (Logon)
  • Windows Security Event ID 4697 (Service Installed)
  • Windows System Event ID 7045 (Service Installed)

FP Rate: Medium

Use Case: Active hunt for lateral movement campaigns; identifies PsExec-style and WMI execution

Detection Logic

Network Logon (4624, LogonType 3) AND one of:
  Service Created with:
    - Name: matches random pattern (8-10 char alpha-numeric)
    - Binary Path: \Windows\Temp\ OR \Users\Public\ OR \ProgramData\
  OR Process Created with:
    - Parent: wmiprvse.exe OR services.exe
    - Image: cmd.exe OR powershell.exe
    - Path: unusual system paths
Sigma Rule — Hunt Level
View on GitHub Download 
title: Suspicious Service Created After Network Logon — Remote Execution Pattern
id: f2a6b8c0-d2e4-4f6a-8b0c-0d1e2f3a4b5c
status: experimental
description: >
  Detects suspicious service installations with random-looking names or binaries
  located in user-writable paths. This pattern is characteristic of Impacket's
  psexec.py and smbexec.py, CrackMapExec, and NetExec SMB execution modules, which
  create short-lived services with auto-generated names in temporary locations.
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://attack.mitre.org/techniques/T1047/
  - https://www.socinvestigation.com/threat-hunting-with-eventid-5145-object-access-detailed-file-share/
  - https://github.com/fortra/impacket
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.execution
  - attack.t1569.002
  - detection.maturity.hunt
logsource:
  product: windows
  service: system
detection:
  selection_service_install:
    EventID: 7045
  # Service binary located in suspicious paths (user-writable, temp locations)
  filter_suspicious_path:
    ImagePath|contains:
      - '\Windows\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
      - '\AppData\Local\Temp\'
      - '\AppData\Roaming\'
  # OR service binary executes cmd/powershell (common for shell-based execution)
  filter_shell_execution:
    ImagePath|contains:
      - 'cmd.exe'
      - 'powershell.exe'
      - 'pwsh.exe'
  condition: selection_service_install and (filter_suspicious_path or filter_shell_execution)
falsepositives:
  - Legitimate software installers that temporarily use Windows\Temp (verify binary is signed)
  - Some legitimate monitoring agents that run from non-standard paths
  - Custom IT deployment scripts that create temporary services
level: medium

Goal: Network logon + IPC$ access + suspicious service or multiple hosts in spray pattern

Log Sources

  • Sysmon Event ID 1 (Process Creation)
  • Sysmon Event ID 3 (Network Connection)
  • Windows Security Event ID 4624 (Logon)
  • Windows Security Event ID 4697/7045 (Service)
  • Windows Security Event ID 5145 (Detailed File Share)

FP Rate: Low

Use Case: SOC alerting for active lateral movement; direct IR escalation trigger

Detection Logic

Network Logon (4624, LogonType 3) + IPC$ share access (5145, ShareName = IPC$) + Service creation with suspicious characteristics:
    Name: 8-10 random alphanumeric characters
    Binary: runs from \Windows\Temp\ OR \Users\Public\ OR command is cmd.exe/powershell.exe
OR + Pattern: same source IP accessing 3+ hosts within 10 minutes (spray) Source IP: internal lateral movement (RFC1918 source to RFC1918 destination)
Sigma Rule — Analyst Level
View on GitHub Download 
title: Impacket-Style Remote Execution — Network Logon, IPC$ Access, Suspicious Service
id: a3b7c9d1-e3f5-4a7b-9c1d-1e2f3a4b5c6d
status: experimental
description: >
  High-fidelity detection for Impacket psexec.py, smbexec.py, CrackMapExec, and NetExec
  SMB execution patterns. Looks for the combination of network logon, IPC$ share access,
  and suspicious service creation (random name, temporary binary path) — all three must
  be present from the same source within a short time window. This three-event correlation
  dramatically reduces false positives compared to individual event detection.
references:
  - https://attack.mitre.org/techniques/T1021/002/
  - https://www.socinvestigation.com/threat-hunting-with-eventid-5145-object-access-detailed-file-share/
  - https://github.com/fortra/impacket
  - https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2022/06/23093553/Common-TTPs-of-the-modern-ransomware_low-res.pdf
author: "@iimp0ster"
date: 2025/01/15
tags:
  - attack.lateral_movement
  - attack.t1021.002
  - attack.execution
  - attack.t1569.002
  - detection.maturity.analyst
logsource:
  product: windows
  service: system
detection:
  # Focus on the clearest signal: service installed from temp path after logon
  # The IPC$ correlation must be done at the SIEM/pipeline level
  selection_service_install:
    EventID: 7045
  filter_suspicious_path:
    ImagePath|contains:
      - '\Windows\Temp\'
      - '\Users\Public\'
      - '\ProgramData\'
  filter_command_exec:
    ImagePath|contains:
      - '%COMSPEC%'
      - 'cmd.exe /Q /c'
      - 'cmd.exe /C'
  filter_random_service:
    # Impacket psexec generates random 8-char service names like "TrPFXzGH"
    # This regex check should be done at SIEM level; approximated here
    ServiceName|re: '^[A-Za-z]{6,12}$'
  condition: selection_service_install and (filter_suspicious_path or filter_command_exec or filter_random_service)
falsepositives:
  - Authorized use of PsExec or Impacket by red teams (check with security team)
  - SCCM/Intune deployments that use temporary service paths (verify source IP)
  - Legitimate remote admin via sc.exe from known admin workstations
level: high

Early Detection Layers

Detect before the user pastes or executes — earlier in the kill chain than the Sysmon-based rules above, using different data sources.

OSINT Sources

Shodan port:5985 product:"Microsoft HTTPAPI"

Finds internet-exposed WinRM endpoints; narrow with 'org:' or 'net:' filters to audit your own attack surface — run a second query on port 5986 for the HTTPS variant.

 Shodan ssl.jarm:07d14d16d21d21d00042d41d00041de5fb3038104f457d92ba37e62256d5 port:443

Clusters of hosts sharing this default Cobalt Strike JARM fingerprint are likely team servers; more resilient to infrastructure rotation than IP/domain blocklists.

 GitHub Code Search "wmiexec" OR "smbexec" OR "atexec" path:*.py

Finds community tools built on Impacket execution primitives; use for defender awareness of new modules extending the execution surface.

Intel Resources

Related Chokepoints

Ransomware Service Manipulation CRITICAL