Windows: NetExec (nxc.exe) Process Execution with Network/Protocol Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

FreeUnreviewedSigmahighv1

windows-netexec-nxc-exe-process-execution-with-network-protocol-commands-7638e5fe

title: "Windows: NetExec (nxc.exe) Process Execution with Network/Protocol Commands"
id: 0026134a-f8b3-4f51-a909-56f32f74d0fb
status: experimental
description: This rule identifies execution of the NetExec binary on Windows by matching process creation where the image ends with nxc.exe and the command line contains protocol-specific keywords (e.g., smb, rdp, ssh, winrm, wmi, ldap, mssql). Such tooling is commonly used for network enumeration and remote command activity, which can enable attackers to map reachable systems and potential access paths. The detection relies on Windows process creation telemetry with access to the executable path and full command line.
references:
  - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
  - https://github.com/Pennyw0rth/NetExec
  - https://www.netexec.wiki/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_netexec.yml
author: Chirag Damani, Huntrule Team
date: 2026-03-29
tags:
  - attack.discovery
  - attack.t1018
  - attack.lateral-movement
  - attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \nxc.exe
    CommandLine|contains:
      - " ftp "
      - " ldap "
      - " mssql "
      - " nfs "
      - " rdp "
      - " smb "
      - " ssh "
      - " vnc "
      - " winrm "
      - " wmi "
  condition: selection
falsepositives:
  - Legitimate use of NetExec by security professionals or system administrators for network assessment and management.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_netexec/info.yml
license: DRL-1.1
related:
  - id: 7638e5fe-600c-4289-a968-f49dd537ec7d
    type: derived

What it detects

This rule identifies execution of the NetExec binary on Windows by matching process creation where the image ends with nxc.exe and the command line contains protocol-specific keywords (e.g., smb, rdp, ssh, winrm, wmi, ldap, mssql). Such tooling is commonly used for network enumeration and remote command activity, which can enable attackers to map reachable systems and potential access paths. The detection relies on Windows process creation telemetry with access to the executable path and full command line.

Known false positives

Legitimate use of NetExec by security professionals or system administrators for network assessment and management.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.