Skip to content
English
Contact us
  • There are no suggestions because the search field is empty.

Impacket Activity Detected [CHK-3028]

This ticket is opened when Microsoft Defender detects Impacket tooling in your environment. Impacket is a collection of Python utilities that speak Windows network protocols directly, and it is widely used to move between machines and extract credentials. The affected device and account, and the actions Attic has already taken, are written into the ticket by the MDR pipeline.

Rationale

Impacket is not a single tool but a toolbox, and the individual utilities cover most of the middle phase of an intrusion. psexec.py, smbexec.py and wmiexec.py execute commands on remote machines. secretsdump.py extracts password hashes from a domain controller or local SAM database. ntlmrelayx.py relays authentication to systems that lack signing. GetUserSPNs.py performs Kerberoasting against service accounts.

What they have in common is that they use legitimate Windows protocols (SMB, WMI, LDAP, Kerberos) the way Windows itself does. That makes the resulting network traffic difficult to separate from normal administration, and it is why Impacket is a staple of both ransomware affiliates and skilled intrusion sets.

Detection almost always indicates hands-on-keyboard activity. Unlike commodity malware, Impacket does not run itself; someone is driving it, has already obtained credentials, and is using them to reach further into your network. Treat it as an intrusion in progress.

Legitimate use is largely confined to authorised penetration testing, and occasionally to administrators who have adopted the tooling for cross-platform management. Both should be verifiable.

Follow-up

Follow these steps to adequately address this detection:

  1. Establish whether this is authorised activity. Check for a penetration test or red team exercise in progress, and whether any administrator uses Impacket for legitimate management from a Linux or macOS host.
    • If no (not authorised): Treat this as an active, hands-on intrusion:
      1. Isolate the source device in Microsoft Defender, and identify the target machines the tooling reached.
      2. Reset the credentials that were used, and every account that had signed in to the affected machines. If secretsdump.py was involved, assume domain credentials are exposed.
      3. Reset the krbtgt account twice where domain hashes may have been dumped, to invalidate forged tickets.
      4. Revoke all active sessions in Entra admin center for affected accounts, and rotate service account and application credentials.
      5. Trace the lateral movement. Review remote logons, service creation, WMI process creation and scheduled tasks on both the source and target machines, in a window before and after the detection.
      6. Escalate to IR immediately. Contact Attic for incident response support. Impacket combined with valid credentials is the standard precursor to ransomware deployment.
    • If yes (authorised): Confirm the details:
      1. Verify the tester or administrator, the scope and the time window.
      2. Where an administrator is using it routinely, move that activity to a documented management path with named accounts, so future detections are distinguishable.
      3. Record the confirmation on the ticket.
  2. Review the conditions that make relaying possible. Where ntlmrelayx.py is involved, enable SMB signing and LDAP signing and channel binding, and disable NTLM where you can. These remove the technique rather than detecting it.

More information