Sigma rule: HackTool - NetExec File Indicators

Rule

Title

HackTool - NetExec File Indicators

Status

experimental

Level

high

Author

Swachchhanda Shrawan Poudel (Nextron Systems)

Date

2026-04-08

File

rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects file creation events indicating NetExec (nxc.exe) execution on the local machine.
NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory
under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that
extraction path are unique to NetExec and serve as reliable on-disk indicators of execution.
NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for
Active Directory enumeration, credential harvesting, and remote code execution.

Log source

product

windows

category

file_event

Detection

selection:
    - Image|contains: '\nxc-windows-latest\'
    - TargetFilename|contains|all:
          - '\Temp\_MEI'
          - '\nxc\data\'
condition: selection

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.lateral-movement
• attack.discovery
• attack.t1021.002
• attack.t1059.005

MITRE ATT&CK ids this rule names

• T1021.002
• T1059.005

References

• https://github.com/Pennyw0rth/NetExec
• https://www.netexec.wiki/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml