Impacket atexec Scheduled Task Creates netsh Port-Proxy Rule

Arnold Chan@slaz

•updated 23 days ago•0•0•1

Detects the use of netsh.exe to establish a port proxy, specifically conditioned on the execution context of the Impacket atexec tool (indicated by specific naming patterns and parent processes). This activity often follows the lateral movement or execution of a remote service by a tool like Impacket.