Windows NetExec Execution Indicators via PyInstaller _MEI Temp File Drops

title: Windows NetExec Execution Indicators via PyInstaller _MEI Temp File Drops
id: ca3cb196-a3ec-4dc1-88b3-c8099e7a17d9
status: experimental
description: This rule identifies on-disk indicators consistent with NetExec (nxc.exe) execution by matching newly created file paths under a PyInstaller extraction directory in the Windows Temp folder. It relies on file event telemetry and looks for file locations containing the NetExec embedded data directory name and the extracted _MEI* directory structure, including the unique "\nxc\data\" subdirectory. These file artifacts are important because attackers may attempt to run NetExec for AD enumeration and related post-exploitation activity, leaving distinct execution artifacts on the host.
references:
  - https://github.com/Pennyw0rth/NetExec
  - https://www.netexec.wiki/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-08
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.discovery
  - attack.t1021.002
  - attack.t1059.005
logsource:
  product: windows
  category: file_event
detection:
  selection:
    - Image|contains: \nxc-windows-latest\
    - TargetFilename|contains|all:
        - \Temp\_MEI
        - \nxc\data\
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators/info.yml
license: DRL-1.1
related:
  - id: efc21479-9e83-41da-8cf1-122e06ba8db3
    type: derived