Detectionhighexperimental

HackTool - NetExec File Indicators

Detects file creation events indicating NetExec (nxc.exe) execution on the local machine. NetExec is a PyInstaller-bundled binary that extracts its embedded data files to a "_MEI<random>" directory under the Temp folder upon execution. Files dropped under the "\nxc\" sub-directory of that extraction path are unique to NetExec and serve as reliable on-disk indicators of execution. NetExec (formerly CrackMapExec) is a widely used post-exploitation and lateral movement tool used for Active Directory enumeration, credential harvesting, and remote code execution.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch
Swachchhanda Shrawan Poudel (Nextron Systems)Created Wed Apr 08efc21479-9e83-41da-8cf1-122e06ba8db3windows
Log Source
WindowsFile Event
ProductWindows← raw: windows
CategoryFile Event← raw: file_event

Events for file system activity including creation, modification, and deletion.

Detection Logic
Detection Logic1 selector
detection:
    selection:
        - Image|contains: '\nxc-windows-latest\'
        - TargetFilename|contains|all:
              - '\Temp\_MEI'
              - '\nxc\data\'
    condition: selection
False Positives
Unknown

False positive likelihood has not been assessed. Additional context may be needed during triage.

Testing & Validation

Regression Tests

by Swachchhanda Shrawan Poudel (Nextron Systems)
Positive Detection Test7 matchesevtx

Microsoft-Windows-Sysmon

Rule Metadata
Rule ID
efc21479-9e83-41da-8cf1-122e06ba8db3
Status
experimental
Level
high
Type
Detection
Created
Wed Apr 08
Path
rules/windows/file/file_event/file_event_win_hktl_netexec_file_indicators.yml
Raw Tags
attack.executionattack.lateral-movementattack.discoveryattack.t1021.002attack.t1059.005
View on GitHub