huntrule

Windows Process Creation: Impacket Toolset Binary Execution (Static Exe Names)

Flags execution of Windows impacket compiled binaries based on distinctive tool names in the process Image.

FreeUnreviewedSigmahighv1
title: "Windows Process Creation: Impacket Toolset Binary Execution (Static Exe Names)"
id: 5ede2014-9589-4a8d-838e-30a1ad91baf2
status: test
description: This rule matches Windows process creation events where the executed binary’s path or filename contains specific strings associated with impacket tools (e.g., goldenPac, secretsdump) or ends with known impacket compiled executable names. Attackers often use impacket binaries to perform credential access, discovery, and lateral movement, making execution of these tools a high-signal indicator. The detection relies on process creation telemetry, specifically the Image path/filename substring and suffix matching, and may produce false positives when impacket is used legitimately.
references:
  - https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-24
modified: 2023-02-07
tags:
  - attack.collection
  - attack.execution
  - attack.credential-access
  - attack.t1557.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - Image|contains:
        - \goldenPac
        - \karmaSMB
        - \kintercept
        - \ntlmrelayx
        - \rpcdump
        - \samrdump
        - \secretsdump
        - \smbexec
        - \smbrelayx
        - \wmiexec
        - \wmipersist
    - Image|endswith:
        - \atexec_windows.exe
        - \dcomexec_windows.exe
        - \dpapi_windows.exe
        - \findDelegation_windows.exe
        - \GetADUsers_windows.exe
        - \GetNPUsers_windows.exe
        - \getPac_windows.exe
        - \getST_windows.exe
        - \getTGT_windows.exe
        - \GetUserSPNs_windows.exe
        - \ifmap_windows.exe
        - \mimikatz_windows.exe
        - \netview_windows.exe
        - \nmapAnswerMachine_windows.exe
        - \opdump_windows.exe
        - \psexec_windows.exe
        - \rdp_check_windows.exe
        - \sambaPipe_windows.exe
        - \smbclient_windows.exe
        - \smbserver_windows.exe
        - \sniff_windows.exe
        - \sniffer_windows.exe
        - \split_windows.exe
        - \ticketer_windows.exe
  condition: selection
falsepositives:
  - Legitimate use of the impacket tools
level: high
license: DRL-1.1
related:
  - id: 4627c6ae-6899-46e2-aa0c-6ebcb1becd19
    type: derived

What it detects

This rule matches Windows process creation events where the executed binary’s path or filename contains specific strings associated with impacket tools (e.g., goldenPac, secretsdump) or ends with known impacket compiled executable names. Attackers often use impacket binaries to perform credential access, discovery, and lateral movement, making execution of these tools a high-signal indicator. The detection relies on process creation telemetry, specifically the Image path/filename substring and suffix matching, and may produce false positives when impacket is used legitimately.

Known false positives

  • Legitimate use of the impacket tools

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.