Sigma rule: HackTool - Impacket Tools Execution

Rule

Title

HackTool - Impacket Tools Execution

Status

test

Level

high

Author

Florian Roth (Nextron Systems)

Date

2021-07-24

Modified

2023-02-07

File

rules/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of different compiled Windows binaries of the impacket toolset (based on names or part of their names - could lead to false positives)

Log source

product

windows

category

process_creation

Detection

selection:
    - Image|contains:
          - '\goldenPac'
          - '\karmaSMB'
          - '\kintercept'
          - '\ntlmrelayx'
          - '\rpcdump'
          - '\samrdump'
          - '\secretsdump'
          - '\smbexec'
          - '\smbrelayx'
          - '\wmiexec'
          - '\wmipersist'
    - Image|endswith:
          - '\atexec_windows.exe'
          - '\dcomexec_windows.exe'
          - '\dpapi_windows.exe'
          - '\findDelegation_windows.exe'
          - '\GetADUsers_windows.exe'
          - '\GetNPUsers_windows.exe'
          - '\getPac_windows.exe'
          - '\getST_windows.exe'
          - '\getTGT_windows.exe'
          - '\GetUserSPNs_windows.exe'
          - '\ifmap_windows.exe'
          - '\mimikatz_windows.exe'
          - '\netview_windows.exe'
          - '\nmapAnswerMachine_windows.exe'
          - '\opdump_windows.exe'
          - '\psexec_windows.exe'
          - '\rdp_check_windows.exe'
          - '\sambaPipe_windows.exe'
          - '\smbclient_windows.exe'
          - '\smbserver_windows.exe'
          - '\sniff_windows.exe'
          - '\sniffer_windows.exe'
          - '\split_windows.exe'
          - '\ticketer_windows.exe'
          # - '\addcomputer_windows.exe'
          # - '\esentutl_windows.exe'
          # - '\getArch_windows.exe'
          # - '\lookupsid_windows.exe'
          # - '\mqtt_check_windows.exe'
          # - '\mssqlclient_windows.exe'
          # - '\mssqlinstance_windows.exe'
          # - '\ntfs-read_windows.exe'
          # - '\ping_windows.exe'
          # - '\ping6_windows.exe'
          # - '\raiseChild_windows.exe'
          # - '\reg_windows.exe'
          # - '\registry-read_windows.exe'
          # - '\services_windows.exe'
          # - '\wmiquery_windows.exe'
condition: selection

False positives (as the rule lists them)

• Legitimate use of the impacket tools

Tags

• attack.collection
• attack.execution
• attack.credential-access
• attack.t1557.001

MITRE ATT&CK ids this rule names

• T1557.001

References

• https://github.com/ropnop/impacket_static_binaries/releases/tag/0.9.21-dev-binaries

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_impacket_tools.yml