Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Flags Windows execution of NetExec (nxc.exe) when command lines include SMB/RDP/SSH/WinRM/WMI and other protocol keywords.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Chirag Damani (SigmaHQ), DRL 1.1
Published: 2026-03-29
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Discovery → Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1018Remote System Discovery
Lateral Movement
- T1021Remote Services
Collection
C2
Exfiltration
Impact

What it detects

This rule flags execution of the NetExec binary (nxc.exe) when its command line includes strings associated with common network service targets and remote protocols. Such tooling is often used for Active Directory discovery, network enumeration, and remote command execution, which can enable credential and lateral movement opportunities for an attacker. It relies on Windows process creation telemetry capturing the executable path/name and the full command line arguments.

Reporting behind it

Related detections9 linkedT1018 — drag to rearrange

Suspicious Domain Controller Enumeration via Nltest by DeadLock Ransomware

Malicious DNS Hosts File Accessed via Network Share (via security)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious Remote Connection to ADWS Port 9389 via security

Uncommon Domain Trust Discovery via Nltest (via process_creation)

Suspicious AdFind Active Directory Reconnaissance Tool Execution (via process_creation)

Suspicious LocalAccountTokenFilterPolicy Enabled via Registry by BlackByte Ransomware

Suspicious Domain Controller and Trust Enumeration via Nltest

Suspicious Active Directory Enumeration via ADWS PowerShell Cmdlets via ps_script

Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands

Pivot detection · T1018 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-netexec-nxc-exe-process-execution-with-network-protocol-commands-7638e5fe

title: "Windows: Detect NetExec (nxc.exe) Process Execution with Network Service Commands"
id: 0026134a-f8b3-4f51-a909-56f32f74d0fb
status: experimental
description: This rule flags execution of the NetExec binary (nxc.exe) when its command line includes strings associated with common network service targets and remote protocols. Such tooling is often used for Active Directory discovery, network enumeration, and remote command execution, which can enable credential and lateral movement opportunities for an attacker. It relies on Windows process creation telemetry capturing the executable path/name and the full command line arguments.
references:
  - https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
  - https://github.com/Pennyw0rth/NetExec
  - https://www.netexec.wiki/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_netexec.yml
author: Chirag Damani, Huntrule Team
date: 2026-03-29
tags:
  - attack.discovery
  - attack.t1018
  - attack.lateral-movement
  - attack.t1021
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \nxc.exe
    CommandLine|contains:
      - " ftp "
      - " ldap "
      - " mssql "
      - " nfs "
      - " rdp "
      - " smb "
      - " ssh "
      - " vnc "
      - " winrm "
      - " wmi "
  condition: selection
falsepositives:
  - Legitimate use of NetExec by security professionals or system administrators for network assessment and management.
level: high
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_hktl_netexec/info.yml
license: DRL-1.1
related:
  - id: 7638e5fe-600c-4289-a968-f49dd537ec7d
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL