Impacket: The Python Toolkit Behind Active Directory Intrusions

Impacket is an open-source collection of Python classes for constructing and parsing low-level network protocols — SMB, MSRPC/DCE-RPC, Kerberos, LDAP — shipped with example scripts that implement real attacks against those protocols. It is a legitimate staple for network engineers, protocol researchers and pentesters, but its example scripts (secretsdump, wmiexec, psexec, smbexec, ntlmrelayx, GetUserSPNs, GetNPUsers) are among the most abused tools in Active Directory intrusions for credential access, lateral movement and NTLM relay. MITRE ATT&CK tracks it as Software entry S0357. It was created by SecureAuth’s Core Security research team and, since 2023, is maintained by Fortra.

Key Scripts

• secretsdump.py — remote credential dumping: SAM, LSA Secrets, cached creds and the NTDS.dit AD database, plus DCSync-style replication, often without touching LSASS on the target. T1003.003 T1003.006
• wmiexec.py — semi-interactive remote execution over WMI; no service created, runs as the authenticated user. T1047
• smbexec.py / psexec.py — execution over SMB; psexec writes a service binary to disk and runs as SYSTEM (noisier). T1021.002 T1569.002
• ntlmrelayx.py / smbrelayx.py — relay captured or poisoned NetNTLM authentication to other services for code execution or credential collection. T1557.001
• GetUserSPNs.py / GetNPUsers.py — Kerberoasting and AS-REP roasting. T1558.003 T1558.004

Real-World Abuse

Red Canary reports Impacket used by Scattered Spider and Fog ransomware affiliates for lateral movement and credential access, often alongside Cobalt Strike and Mimikatz; secretsdump.py is the single most commonly observed Impacket script in their customer environments. Confirm any further group attributions against MITRE’s live S0357 “Groups” tab.

MITRE ATT&CK Mapping

Detection & Mitigation

• wmiexec.py redirects command output to a file in the target’s ADMIN$ share whose name contains an epoch timestamp — a strong, documented hunting artifact; remote execution is generally staged through ADMIN$. The Sigma rule “HackTool - Potential Impacket Lateral Movement Activity” keys on these patterns.
• Alert on psexec service-install events (odd-named service and binary written to disk) and on DCSync replication requests (DC Event ID 4662 for directory-replication rights) from non-DC accounts; restrict Replicating Directory Changes rights.
• Defend against NTLM relay: require SMB signing, enable LDAP channel binding and signing, disable NTLM where possible, and disable LLMNR/NBT-NS to cut poisoning.
• Monitor Kerberoasting (high-volume TGS-REQ, especially RC4) and AS-REP roasting; enforce long managed service-account passwords (gMSA) and tier admin credentials.