huntrule

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Chirag Damani (SigmaHQ), DRL 1.1
Published
2026-03-29
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Discovery → Lateral Movement

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags execution of the NetExec binary (nxc.exe) when its command line includes strings associated with common network service targets and remote protocols. Such tooling is often used for Active Directory discovery, network enumeration, and remote command execution, which can enable credential and lateral movement opportunities for an attacker. It relies on Windows process creation telemetry capturing the executable path/name and the full command line arguments.

Reporting behind it

Related detections9 linkedT1018 — drag to rearrange
Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware
Malicious DNS Hosts File Accessed via Network Share (via security)
Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)
Suspicious Remote Connection to ADWS Port 9389 via security
Uncommon Domain Trust Discovery via Nltest (via process_creation)
Suspicious AdFind Active Directory Reconnaissance Tool Execution (via process_creation)
Suspicious LocalAccountTokenFilterPolicy Enabled via Registry by BlackByte Ransomware
Suspicious Domain Controller and Trust Enumeration via Nltest
Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script
Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands
Pivot detection · T1018 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.