Windows HackTool Indicators: NetExec (nxc.exe) PyInstaller Extraction Artifacts

Flags Windows file creation under Temp\_MEI* where NetExec nxc data files are dropped, indicating likely NetExec execution.

FreeReviewedSigma · High · v2

Product: windows
Category: file_event
Author: Swachchhanda Shrawan Poudel (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2026-04-08
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
- T1059.005Visual Basic
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1021.002SMB/Windows Admin Shares
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies Windows file creation events consistent with NetExec (nxc.exe) execution on a local host. It looks for a combination of execution-related content in the image path and on-disk PyInstaller extraction under the Temp directory, specifically including the extracted _MEI* folder and the nxc\data subdirectory. These extracted files are strong on-disk indicators because they are produced during NetExec startup as it unpacks embedded data to a temporary directory.

Reporting behind it

Related detections9 linkedT1059.005 — drag to rearrange

Malicious mshta Launching WScript VBScript Loader

Suspicious Impacket Style Command Execution with ADMIN Share Output Redirect

Suspicious Active Directory Reconnaissance via In-Memory Offensive PowerShell (via ps_script)

Suspicious NetExec Post-Exploitation Tool Execution via nxc (via process_creation)

Suspicious wscript Execution Forcing VBScript Engine in Batch Mode

Suspicious Batch Script Execution Spawned by wscript via VBScript

Suspicious NW.js Runtime Execution from AppData Roaming by Charcoal Stork (via process_creation)

Suspicious SMB Admin Share Mapping for Lateral Tool Transfer (via process_creation)

Suspicious WScript VBS Execution from Temp Directory in CVE-2023-36884 Exploit Chain

Windows HackTool Indicators: NetExec (nxc.exe) PyInstaller Extraction Artifacts

Pivot detection · T1059.005 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-netexec-execution-indicators-via-pyinstaller-mei-temp-file-drops-efc21479

title: "Windows HackTool Indicators: NetExec (nxc.exe) PyInstaller Extraction Artifacts"
id: ca3cb196-a3ec-4dc1-88b3-c8099e7a17d9
status: experimental
description: This rule identifies Windows file creation events consistent with NetExec (nxc.exe) execution on a local host. It looks for a combination of execution-related content in the image path and on-disk PyInstaller extraction under the Temp directory, specifically including the extracted _MEI* folder and the nxc\data subdirectory. These extracted files are strong on-disk indicators because they are produced during NetExec startup as it unpacks embedded data to a temporary directory.
references:
  - https://github.com/Pennyw0rth/NetExec
  - https://www.netexec.wiki/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml
author: Swachchhanda Shrawan Poudel (Nextron Systems), Huntrule Team
date: 2026-04-08
tags:
  - attack.execution
  - attack.lateral-movement
  - attack.discovery
  - attack.t1021.002
  - attack.t1059.005
logsource:
  product: windows
  category: file_event
detection:
  selection:
    - Image|contains: \nxc-windows-latest\
    - TargetFilename|contains|all:
        - \Temp\_MEI
        - \nxc\data\
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators/info.yml
license: DRL-1.1
related:
  - id: efc21479-9e83-41da-8cf1-122e06ba8db3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL