Impacket SMBExec Activity

SMBExec is a python script included in the Impacket toolset. SMBExec creates a semi-interactive shell process that can start services on a remote device. Attacks with SMBExec, where commands are hidden in Windows service requests, can be difficult to detect because the attack does not require a malware download.

An attacker that has obtained local administrator privileges inside the network identifies a victim device they want to compromise. The attacker runs SMBExec, which sends an RPC request over SMB to the victim. This request opens Microsoft Service Control Manager (SCM), starts a new service with the default name BTOBTO, and instructs the service to run a command contained within the request. The service directs the output of the command to a temporary file and then the attacker retrieves the file. Finally, SMBExec deletes the file and the service to hide evidence of compromise.