Most Popular Detection 2026: Impacket Toolkit Lateral Movement (wmiexec/secretsdump)
This rule detects artifacts and command-line patterns associated with Impacket utility suite modules, specifically wmiexec.py, smbexec.py, and secretsdump.py. These tools are commonly used by adversaries for remote command execution, lateral movement, and dumping of sensitive domain or system credentials.
Sigma
