Impacket-Style Lateral Movement and Credential Dumping (psexec/secretsdump Pattern)

Ankit Mehta@Secvyn

•updated Aug 11, 2026•0•0•6

Detects two distinct offensive patterns: Impacket PsExec usage, identified by a Type-3 network logon followed within 2 minutes by an ADMIN$ service installation matching typical PsExec naming patterns; and DCSync replication requests originating from non-Domain Controller accounts.