Defense Against the Lateral Arts: Detecting and Preventing Impacket’s Wmiexec

Impacket, an open source collection of Python modules for manipulating network protocols, contains several tools for remote service execution, Windows credential dumping, packet sniffing and Kerberos manipulation. CrowdStrike Services has seen an increased use of Impacket’s wmiexec module, primarily by ransomware and eCrime groups. Wmiexec leaves behind valuable forensic artifacts that will help defenders detect […]

defense featured from the front lines impacket