Tag
high
advisory
Detection of CrackMapExec Post-Exploitation Execution Patterns
1 rule 3 TTPsDetection engineering brief covering common command-line execution patterns generated by the CrackMapExec (CME) post-exploitation framework during lateral movement and command execution.
lateral-movement
post-exploitation
crackmapexec
offensive-tooling
1r
3t
high
advisory
NetExec File Creation Detection
2 rules 3 TTPsThis brief covers the detection of NetExec, a post-exploitation and lateral movement tool, through monitoring for unique file creation patterns associated with its execution and file extraction in Windows environments.
Windows +1
netexec
crackmapexec
lateral-movement
post-exploitation
hacktool
2r
3t