Detection: Impacket Lateral Movement smbexec CommandLine Parameters

Description

This analytic focuses on identifying suspicious command-line parameters commonly associated with the use of Impacket wmiexec.py. Impacket is a set of Python classes designed for working with Microsoft network protocols, and it includes several scripts like wmiexec.py, smbexec.py, dcomexec.py, and atexec.py that enable command execution on remote endpoints. These scripts typically utilize administrative shares and hardcoded parameters, which can serve as signatures to detect their usage. Both Red Teams and adversaries may employ Impacket tools for lateral movement and remote code execution purposes. By monitoring for these specific command-line indicators, the analytic aims to detect potentially malicious activities related to Impacket tool usage.

Annotations

No annotations available.

Implementation

The detection is based on data that originates from Endpoint Detection and Response (EDR) agents. These agents are designed to provide security-related telemetry from the endpoints where the agent is installed. To implement this search, you must ingest logs that contain the process GUID, process name, and parent process. Additionally, you must ingest complete command-line executions. These logs must be processed using the appropriate Splunk Technology Add-ons that are specific to the EDR product. The logs must also be mapped to the Processes node of the Endpoint data model. Use the Splunk Common Information Model (CIM) to normalize the field names and speed up the data modeling process.

Known False Positives

Although uncommon, Administrators may leverage Impackets tools to start a process on remote systems for system administration or automation use cases.

Associated Analytic Story

• Active Directory Lateral Movement

• CISA AA22-277A

• WhisperGate

• Prestige Ransomware

• Volt Typhoon

• Graceful Wipe Out Attack

• Industroyer2

• Data Destruction

Risk Based Analytics (RBA)

References

• https://attack.mitre.org/techniques/T1021/002/

• https://attack.mitre.org/techniques/T1021/003/

• https://attack.mitre.org/techniques/T1047/

• https://attack.mitre.org/techniques/T1053/

• https://attack.mitre.org/techniques/T1053/005/

• https://github.com/SecureAuthCorp/impacket

• https://vk9-sec.com/impacket-remote-code-execution-rce-on-windows-from-linux/

• https://www.microsoft.com/security/blog/2022/01/15/destructive-malware-targeting-ukrainian-organizations/

• https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/

Version: 1