Live Active security incident? Get immediate response
MITRE ATT&CK® Tool

S0488: CrackMapExec

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]

EnterpriseS0488ToolObject v1.1 Modified
Discuss defensive coverage Back to ATT&CK
Glexia's Take

Analyst context for executives and security teams

Analyst confidence Medium

CrackMapExec is a Windows-focused post-exploitation and penetration-testing tool that can collect Active Directory information and support lateral movement. For leaders, its significance is not the tool name itself, but what its presence may imply: credential exposure, domain discovery, remote execution paths, and Windows administrative protocols being usable at scale inside the network.

Executive priority

Prioritize this as an Active Directory and lateral-movement readiness issue. The ATT&CK relationships connect CrackMapExec to credential access, discovery, WMI execution, password guessing/spraying, pass-the-hash, registry modification, and network share discovery. Executives should ask whether the organization can prove visibility across domain controllers, Windows endpoints, authentication activity, SMB/WMI use, PowerShell, and privileged account behavior. This is also relevant to resilience and compliance evidence because several related groups are described by ATT&CK as targeting sectors including critical infrastructure, finance, government, hospitality, telecommunications, utilities, and other enterprises.

Technical view

SOC and IR teams should validate coverage around the Windows and Active Directory behaviors mapped to this tool rather than relying on a tool-name signature. ATT&CK does not provide a detection section for S0488, so detection should be built from the related techniques: SAM/NTDS/LSA credential access, domain account and group enumeration, password policy discovery, remote system and network share discovery, WMI execution, PowerShell execution, At-based scheduling, registry modification, brute force/password guessing/password spraying, and pass-the-hash. Focus on sequences where account enumeration, share discovery, authentication attempts, and remote execution occur close together across multiple hosts.

Likely telemetry

  • Windows endpoint process creation and command-line telemetry
  • PowerShell execution logs and script/block telemetry where available
  • WMI operational and remote execution telemetry
  • Windows Security authentication events, including failed and successful logons
  • Domain controller logs for account, group, password policy, and directory queries

Detection direction

  • Validate behavior-based detections for clustered Active Directory enumeration followed by authentication attempts or remote execution.
  • Tune for password spraying and guessing patterns across many accounts while accounting for legitimate administrative scanners and vulnerability assessment activity.
  • Monitor WMI, PowerShell, SMB, and scheduled execution in combination; single events may be administrative, but chained discovery and execution across many hosts is higher signal.
  • Confirm domain controller visibility for NTDS, SAM/LSA-related access, and unusual directory enumeration.
  • Account for authorized penetration testing: CrackMapExec may be used legitimately, so detections should include change windows, tester accounts, source hosts, and approved scope.

Mitigation priorities

  • Start with identity hygiene: protect privileged accounts, reduce standing administrative access, and review exposure to pass-the-hash and credential dumping paths.
  • Harden Active Directory and domain controllers, including monitoring and restricting access to sensitive credential stores such as NTDS, SAM, and LSA secrets.
  • Reduce lateral movement paths by limiting SMB/WMI administrative access to necessary management systems and accounts.
  • Enforce password controls and monitoring that address guessing and spraying without relying only on account lockout.
  • Constrain and monitor PowerShell, WMI, registry modification, and scheduled execution according to administrative need.
Analyst notes and limits

ATT&CK identifies CrackMapExec as a Python post-exploitation tool designed for penetration testing against networks and used to collect Active Directory information for lateral movement. ATT&CK relationships also list use by Dragonfly, FIN7, MuddyWater, APT39, and Ember Bear, and map the tool to multiple Windows/AD-centered techniques. Treat these relationships as threat-intelligence context, not proof of activity in any specific environment.

The supplied ATT&CK object has no official detection guidance and no explicit tactics listed for the tool itself. Telemetry and control recommendations are derived from the supplied related techniques and the Windows platform designation. Local baselines, administrative practices, logging configuration, and authorized penetration-test activity are required to determine actual risk and detection quality.

Official MITRE ATT&CK definition

CrackMapExec

CrackMapExec, or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. CrackMapExec collects Active Directory information to conduct lateral movement through targeted networks.[1]

View the same entry on attack.mitre.org (MITRE-hosted reference; in-page links above use the Glexia ATT&CK library.)

Glexia analysis

How security teams should use this page

Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.

ATT&CK relationship table

Techniques used

This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.

20 rows
Domain ID Name Relationship / procedure
Enterprise T1003.002 Security Account Manager Sub-technique

CrackMapExec can dump usernames and hashed passwords from the SAM.CitationCME Github September 2018
Enterprise T1003.003 NTDS Sub-technique

CrackMapExec can dump hashed passwords associated with Active Directory using Windows' Directory Replication Services API (DRSUAPI), or Volume Shadow Copy.CitationCME Github September 2018
Enterprise T1110.003 Password Spraying Sub-technique

CrackMapExec can brute force credential authentication by using a supplied list of usernames and a single password.CitationCME Github September 2018
Enterprise T1201 Password Policy Discovery

CrackMapExec can discover the password policies applied to the target system.CitationCME Github September 2018
Enterprise T1087.002 Domain Account Sub-technique

CrackMapExec can enumerate the domain user accounts on a targeted system.CitationCME Github September 2018
Enterprise T1049 System Network Connections Discovery

CrackMapExec can discover active sessions for a targeted system.CitationCME Github September 2018
Enterprise T1110.001 Password Guessing Sub-technique

CrackMapExec can brute force passwords for a specified user on a single target system or across an entire network.CitationCME Github September 2018
Enterprise T1053.002 At Sub-technique

CrackMapExec can set a scheduled task on the target system to execute commands remotely using at.CitationCME Github September 2018
Enterprise T1135 Network Share Discovery

CrackMapExec can enumerate the shared folders and associated permissions for a targeted network.CitationCME Github September 2018
Enterprise T1018 Remote System Discovery

CrackMapExec can discover active IP addresses, along with the machine name, within a targeted network.CitationCME Github September 2018
Enterprise T1003.004 LSA Secrets Sub-technique

CrackMapExec can dump hashed passwords from LSA secrets for the targeted system.CitationCME Github September 2018
Enterprise T1047 Windows Management Instrumentation

CrackMapExec can execute remote commands using Windows Management Instrumentation.CitationCME Github September 2018
Enterprise T1112 Modify Registry

CrackMapExec can create a registry key using wdigest.CitationCME Github September 2018
Enterprise T1083 File and Directory Discovery

CrackMapExec can discover specified filetypes and log files on a targeted system.CitationCME Github September 2018
Enterprise T1550.002 Pass the Hash Sub-technique

CrackMapExec can pass the hash to authenticate via SMB.CitationCME Github September 2018
Enterprise T1680 Local Storage Discovery

CrackMapExec can enumerate the system drives and associated system name.CitationCME Github September 2018
Enterprise T1069.002 Domain Groups Sub-technique

CrackMapExec can gather the user accounts within domain groups.CitationCME Github September 2018
Enterprise T1059.001 PowerShell Sub-technique

CrackMapExec can execute PowerShell commands via WMI.CitationCME Github September 2018
Enterprise T1016 System Network Configuration Discovery

CrackMapExec can collect DNS information from the targeted system.CitationCME Github September 2018
Enterprise T1110 Brute Force

CrackMapExec can brute force supplied user credentials across a network range.CitationCME Github September 2018
Associated objects

Groups, software, and campaigns

Group Enterprise

G0087: APT39

APT39 is one of several names for cyber espionage activity conducted by the Iranian Ministry of Intelligence and Security (MOIS) through the front company Rana Intelligence Computing since at least 2014. APT39 has primarily targeted the travel, hospitality, academic, and telecommunications industries in Iran and across Asia, Africa, Europe, and North America to track individuals and entities considered to be a threat by the MOIS.[1][2][3][4][5]

Group Enterprise

G0046: FIN7

FIN7 is a financially-motivated threat group that has been active since 2013. FIN7 has targeted the retail, restaurant, hospitality, software, consulting, financial services, medical equipment, cloud services, media, food and beverage, transportation, pharmaceutical, and utilities industries in the United States. A portion of FIN7 was operated out of a front company called Combi Security and often used point-of-sale malware for targeting efforts. Since 2020, FIN7 shifted operations to big game hunting (BGH), including use of REvil ransomware and their own Ransomware-as-a-Service (RaaS), Darkside. FIN7 may be linked to the Carbanak Group, but multiple threat groups have been observed using Carbanak, leading these groups to be tracked separately.[1][2][3][4][5][6][7]

Group Enterprise

G1003: Ember Bear

Ember Bear is a Russian state-sponsored cyber espionage group that has been active since at least 2020, linked to Russia's General Staff Main Intelligence Directorate (GRU) 161st Specialist Training Center (Unit 29155).[1] Ember Bear has primarily focused operations against Ukrainian government and telecommunication entities, but has also operated against critical infrastructure entities in Europe and the Americas.[2] Ember Bear conducted the WhisperGate destructive wiper attacks against Ukraine in early 2022.[3][4][1] There is some confusion as to whether Ember Bear overlaps with another Russian-linked entity referred to as Saint Bear. At present available evidence strongly suggests these are distinct activities with different behavioral profiles.[2][5]

Group Enterprise

G0035: Dragonfly

Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]

Group Enterprise

G0069: MuddyWater

MuddyWater is a cyber espionage group assessed to be a subordinate element within Iran's Ministry of Intelligence and Security (MOIS).[1] Since at least 2017, MuddyWater has targeted a range of government and private organizations across sectors, including telecommunications, local government, finance, defense, and oil and natural gas organizations, in the Middle East (specifically the UAE and Saudi Arabia), Asia, Africa, Europe, and North America. MuddyWater has reused domains dating back to October 2025, and has a preference for NameCheap and Hosterdaddy Private Limited (AS136557). In late 2025 and early 2026, MuddyWater used commercial satellite internet (i.e., Starlink) for command and control (C2) communication. [2][3][4][5][6][7][8][9][10][11][12][13]

Campaign Enterprise

C0029: Cutting Edge

Cutting Edge was a campaign conducted by suspected China-nexus espionage actors, variously identified as UNC5221/UTA0178 and UNC5325, that began as early as December 2023 with the exploitation of zero-day vulnerabilities in Ivanti Connect Secure (previously Pulse Secure) VPN appliances. Cutting Edge targeted the U.S. defense industrial base and multiple sectors globally including telecommunications, financial, aerospace, and technology. Cutting Edge featured the use of defense evasion and living-off-the-land (LoTL) techniques along with the deployment of web shells and other custom malware.[1][2][3][4][5]

Relationship explorer

All related ATT&CK context

uses · Technique T1003.002: Security Account Manager Enterprise uses · Technique T1003.003: NTDS Enterprise uses · Technique T1110.003: Password Spraying Enterprise uses · Technique T1201: Password Policy Discovery Enterprise uses · Technique T1087.002: Domain Account Enterprise uses · Technique T1049: System Network Connections Discovery Enterprise uses · Group G0087: APT39 Enterprise uses · Technique T1110.001: Password Guessing Enterprise uses · Technique T1053.002: At Enterprise uses · Technique T1135: Network Share Discovery Enterprise uses · Technique T1018: Remote System Discovery Enterprise uses · Group G0046: FIN7 Enterprise uses · Group G1003: Ember Bear Enterprise uses · Technique T1003.004: LSA Secrets Enterprise uses · Campaign C0029: Cutting Edge Enterprise uses · Technique T1047: Windows Management Instrumentation Enterprise uses · Technique T1112: Modify Registry Enterprise uses · Group G0035: Dragonfly Enterprise uses · Group G0069: MuddyWater Enterprise uses · Technique T1083: File and Directory Discovery Enterprise uses · Technique T1550.002: Pass the Hash Enterprise uses · Technique T1680: Local Storage Discovery Enterprise uses · Technique T1069.002: Domain Groups Enterprise uses · Technique T1059.001: PowerShell Enterprise
Change history

Object version and sync metadata

The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .

ATT&CK release
19.1
Object version
1.1
Created
Modified
Raw hash
b92db6b73925a1ea...
Imported snapshots across ATT&CK releases (1)
Release Bundle imported Object version Modified Status Raw hash
19.1 1.1 Current bundle b92db6b73925…
Raw source

Mirrored ATT&CK source object

The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.

Open mirrored raw JSON Open MITRE-hosted copy
Source references

External references and citations

MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.

  1. [1]
    CME Github September 2018

    byt3bl33d3r. (2018, September 8). SMB: Command Reference. Retrieved July 17, 2020.

    Open source URL
  2. [2]
    mitre-attack S0488
    Open source URL
Source and licensing

Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.

Official MITRE ATT&CK site Official STIX data repository MITRE ATT&CK terms of use