Impacket WMIExec Activity Detection

Google SecOps@GoogleSecOps

•updated Jun 2, 2025•1•0•55

Detects the execution of Impacket's wmiexec.py tool by identifying characteristic command-line arguments and temporary file creation patterns. Specifically, it looks for process launches with command lines redirecting output to a hidden ADMIN$ share path (e.g., `1>\ADMIN$\__... 2>&1`) or the creation of files in the `\windows\__` directory, which are common artifacts left by wmiexec.py.