Sigma rule: HackTool - NetExec Execution

Rule

Title

HackTool - NetExec Execution

Status

experimental

Level

high

Author

Chirag Damani

Date

2026-03-29

File

rules/windows/process_creation/proc_creation_win_hktl_netexec.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of the hacktool NetExec.
NetExec (formerly CrackMapExec) is a widely used post-exploitation tool designed for Active Directory penetration testing and network enumeration
In enterprise environments, the use of NetExec is considered suspicious or potentially malicious because it enables attackers to enumerate hosts, exploit network services, and move laterally across systems.
Threat actors and red teams commonly use NetExec to identify vulnerable systems, harvest credentials, and execute commands remotely.

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith: '\nxc.exe'
    CommandLine|contains:
        - ' ftp '
        - ' ldap '
        - ' mssql '
        - ' nfs '
        - ' rdp '
        - ' smb '
        - ' ssh '
        - ' vnc '
        - ' winrm '
        - ' wmi '
condition: selection

False positives (as the rule lists them)

• Legitimate use of NetExec by security professionals or system administrators for network assessment and management.

Tags

• attack.discovery
• attack.t1018
• attack.lateral-movement
• attack.t1021

MITRE ATT&CK ids this rule names

• T1018
• T1021

References

• https://thedfirreport.com/2025/12/17/cats-got-your-files-lynx-ransomware/
• https://github.com/Pennyw0rth/NetExec
• https://www.netexec.wiki/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_hktl_netexec.yml