detect-impacket-atexec

Hunt Hypothesis

Adversaries may use the impacket atexec module to execute arbitrary code remotely, bypassing traditional detection mechanisms. SOC teams should proactively hunt for this behavior in Azure Sentinel to identify and mitigate potential lateral movement and persistence tactics.

KQL Query

let lookuptime = 30d;
DeviceEvents
| where Timestamp >ago(lookuptime)
| where ActionType == 'NamedPipeEvent' 
| where AdditionalFields contains "atsvc"
| project DeviceName, Timestamp, DeviceId, RemoteIP, PipeName = extractjson("$.PipeName", AdditionalFields, typeof(string)), RemoteClientsAccess = extractjson("$.RemoteClientsAccess", AdditionalFields, typeof(string)), ShareName = extractjson("$.ShareName", AdditionalFields, typeof(string))
| join (
DeviceRegistryEvents
| where Timestamp >ago(lookuptime)
| where ActionType == 'RegistryKeyCreated' 
| where RegistryKey contains @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\"
| project RegTimestamp = Timestamp, DeviceName, DeviceId, RegistryKey, RegistryValueData, RegistryValueName, RegistryValueType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
) on DeviceName, DeviceId
| where RegTimestamp between ((Timestamp - 2m) .. (Timestamp + 2m))
| join (
DeviceProcessEvents
| where Timestamp >ago(lookuptime)
| where InitiatingProcessFileName =~ "svchost.exe"
| where InitiatingProcessCommandLine contains "Schedule"
| project DeviceId, DeviceName, FileName, ProcessCommandLine, ProcessId, ProcessStartTimestamp = Timestamp, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
) on DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
| where ProcessStartTimestamp between ( Timestamp .. (Timestamp +2m))
| project DeviceName, Timestamp, StartedProcess = FileName, StartedProcessCommandLine = ProcessCommandLine, StartedProcessId = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime, RegistryKey, RemoteIP, PipeName

Analytic Rule Definition

id: 75e3a1b2-bd6d-4e79-8c74-85a3bc0b0617
name: detect-impacket-atexec
description: |
  This query looks for signs of impacket atexec module. Should work with others using similar technique.
  Author: Jouni Mikkola
  More info: https://threathunt.blog/impacket-part-3/
requiredDataConnectors:
- connectorId: MicrosoftThreatProtection
  dataTypes:
  - DeviceEvents
  - DeviceRegistryEvents
  - DeviceProcessEvents
tactics:
- Execution
relevantTechniques:
  - T1053 
query: |
  let lookuptime = 30d;
  DeviceEvents
  | where Timestamp >ago(lookuptime)
  | where ActionType == 'NamedPipeEvent' 
  | where AdditionalFields contains "atsvc"
  | project DeviceName, Timestamp, DeviceId, RemoteIP, PipeName = extractjson("$.PipeName", AdditionalFields, typeof(string)), RemoteClientsAccess = extractjson("$.RemoteClientsAccess", AdditionalFields, typeof(string)), ShareName = extractjson("$.ShareName", AdditionalFields, typeof(string))
  | join (
  DeviceRegistryEvents
  | where Timestamp >ago(lookuptime)
  | where ActionType == 'RegistryKeyCreated' 
  | where RegistryKey contains @"HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\"
  | project RegTimestamp = Timestamp, DeviceName, DeviceId, RegistryKey, RegistryValueData, RegistryValueName, RegistryValueType, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
  ) on DeviceName, DeviceId
  | where RegTimestamp between ((Timestamp - 2m) .. (Timestamp + 2m))
  | join (
  DeviceProcessEvents
  | where Timestamp >ago(lookuptime)
  | where InitiatingProcessFileName =~ "svchost.exe"
  | where InitiatingProcessCommandLine contains "Schedule"
  | project DeviceId, DeviceName, FileName, ProcessCommandLine, ProcessId, ProcessStartTimestamp = Timestamp, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
  ) on DeviceName, DeviceId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime
  | where ProcessStartTimestamp between ( Timestamp .. (Timestamp +2m))
  | project DeviceName, Timestamp, StartedProcess = FileName, StartedProcessCommandLine = ProcessCommandLine, StartedProcessId = ProcessId, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId, InitiatingProcessCreationTime, RegistryKey, RemoteIP, PipeName

Required Data Sources

MITRE ATT&CK Context

• Tactic: Execution
• Technique: T1053 — T1053

References

• [Source Query](https://github.com/Azure/Azure-Sentinel/blob/main/Hunting Queries/Microsoft 365 Defender/Execution/detect-impacket-atexec.yaml)

False Positive Guidance

• Scenario: Legitimate scheduled job using at command
  Description: A system administrator schedules a task using the Windows at command to run a script or executable at a specific time.
  Filter/Exclusion: Check for at command usage in scheduled tasks or system logs, and exclude processes associated with the Task Scheduler or schtasks.exe.

• Scenario: Admin task using atexec for remote execution
  Description: A system administrator uses the atexec module (part of Impacket) to execute a command on a remote machine as part of a legitimate administrative task, such as deploying updates.
  Filter/Exclusion: Filter by known admin user accounts (e.g., Administrator, Domain Admins) and check for command-line arguments related to known administrative tasks.

• Scenario: Impacket used for internal network discovery
  Description: Security teams use Impacket tools (e.g., smbclient, nmblookup) for internal network reconnaissance and mapping, which may trigger the detection rule due to similar network activity.
  Filter/Exclusion: Exclude traffic from known security tools or internal security teams, and filter by source IP addresses associated with the security operations team.

• Scenario: Legitimate use of at for batch job execution
  Description: A developer or DevOps engineer uses the at command to schedule a batch job (e.g., data processing, backups) on a Windows server.
  Filter/Exclusion: Filter by user accounts with DevOps or developer privileges, and exclude processes initiated through the Task Scheduler or command-line scripts.

• Scenario: Impacket used for legitimate remote code execution in a test environment
  Description: A red team or security team uses Impacket tools (e.g., atexec) in a controlled test environment to simulate attack scenarios.
  **