CrackMapExecTool
CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.From MITRE ATT&CK
Last reported 4 days ago, by Datadog Security Labs4 reports
ATT&CK techniques
6 of 42 · each with the sentence it comes from- T1110Brute Force
“Brute force”
- T1003OS Credential Dumping
“T1003”
- T1018Remote System Discovery
“T1018”
- T1020Automated Exfiltration
“T1020”
- T1021.002SMB/Windows Admin Shares
“T1021.002”
- T1021.004SSH
“T1021.004”
Reports per month
last 12 monthsOctober so far (hatched). Counted by report, not by story.
What the reports say
4 reports, newest first · the exact sentence from each-
Introducing pathrunner: An AWS privilege escalation framework“Pathrunner's modular design was heavily influenced by a few successful exploitation frameworks of years past, like Metasploit, CrackMapExec (now NetExec), and Empire (now forked and maintained here).”
-
Mallox ransomware affiliate uses PureCrypter in MS-SQL attacks“Note that the CrackMapExec MS-SQL tool leaves a fairly similar trace: a random application name of 8 characters long.”
-
Vibe Hacking: Two AI-Augmented Campaigns Target Government and Financial Sectors in Latin America“Despite sharing tools and tactics, including Chisel, Neo-reGeorg, CrackMapExec, and Impacket, SHADOW-AETHER-040 and SHADOW-AETHER-064 appear to be distinct groups, separated primarily by language: Spanish and Portuguese respectively.”
-
Boring Isn't Harmless: Common Cyberattack Tradecraft Risks“Windows protocols wrapped around hacking tools like Impacket or CrackMapExec”
Indicators in its reports
named in the reports above- 62.171.185[.]97in 1 report
- 165.22.184[.]26in 1 report
- 167.148.195[.]53in 1 report
- 159.65.202[.]204in 1 report
- 167.172.38[.]123in 1 report
- 155.133.27[.]198in 1 report
- 209.99.185[.]221in 1 report
- 209.99.185[.]223in 1 report
- cloudservbr[.]comin 1 report
- infra-telemetry[.]comin 1 report
Copy these 10 indicators · defanged
Thanks — we review every report.