Impacket/PsExec-style SMB lateral movement with admin allowlist exclusions

Duo Tech@duotech

•updated Aug 10, 2026•6•0•14

Detects Impacket-style (wmiexec, secretsdump, atexec, psexec.py, smbclient.py) and PsExec SMB admin-share lateral movement, excluding approved IT admin accounts and management servers.