[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"detail-sidebar-cat-1-en-105":3,"doc-seo-572973-105":53,"doc-detail-572973-en":126},{"code":4,"msg":5,"data":6},0,"success",[7,14,19,24,29,34,39,44,49],{"id":8,"doc_module":9,"doc_module_name":10,"category_name":11,"show_sort_weight":12,"slug":13},11,1,"Template","Presentations",90,"presentations",{"id":15,"doc_module":9,"doc_module_name":10,"category_name":16,"show_sort_weight":17,"slug":18},12,"Resumes",80,"resumes",{"id":20,"doc_module":9,"doc_module_name":10,"category_name":21,"show_sort_weight":22,"slug":23},14,"Invoices",70,"invoices",{"id":25,"doc_module":9,"doc_module_name":10,"category_name":26,"show_sort_weight":27,"slug":28},15,"Posters",60,"posters",{"id":30,"doc_module":9,"doc_module_name":10,"category_name":31,"show_sort_weight":32,"slug":33},16,"Social Media",50,"social-media",{"id":35,"doc_module":9,"doc_module_name":10,"category_name":36,"show_sort_weight":37,"slug":38},17,"Forms",40,"forms",{"id":40,"doc_module":9,"doc_module_name":10,"category_name":41,"show_sort_weight":42,"slug":43},18,"Letters",30,"letters",{"id":45,"doc_module":9,"doc_module_name":10,"category_name":46,"show_sort_weight":47,"slug":48},21,"Paper Templates",5,"papers-templates",{"id":50,"doc_module":9,"doc_module_name":10,"category_name":51,"show_sort_weight":4,"slug":52},158,"General","general-158",{"code":4,"msg":54,"data":55},"ok",{"site_id":56,"language":57,"slug":58,"title":59,"keywords":60,"description":61,"schema_data":62,"social_meta":119,"head_meta":121,"extra_data":123,"updated_unix":125},105,"en","impacket-exec-commands-cheat-sheet-version-11","Impacket Exec Commands Cheat Sheet - Version 1.1","","Impacket Exec Commands Cheat Sheet - Version 1.1 summarizes key usage patterns for executing commands with Impacket tools, including ATEXEC, DCOMEXEC, PSEXEC, and SMBEXEC. It specifies how each method launches payloads, handles shells or arguments, and what artifact cleanup occurs afterward (e.g., scheduled tasks and temporary output files). It also documents Windows event log residue by listing Security and System event IDs linked to execution, service creation, and process activity, with conditional notes for when extra indicators appear or when protections like Windows Defender block execution by default.",{"@graph":63,"@context":118},[64,80,101],{"@type":65,"itemListElement":66},"BreadcrumbList",[67,71,74,77],{"item":68,"name":69,"@type":70,"position":9},"https://docshare.wps.com","Home","ListItem",{"item":72,"name":10,"@type":70,"position":73},"https://docshare.wps.com/template/",2,{"item":75,"name":51,"@type":70,"position":76},"https://docshare.wps.com/template/general/",3,{"item":78,"name":59,"@type":70,"position":79},"https://docshare.wps.com/template/impacket-exec-commands-cheat-sheet-version-11/572973/",4,{"url":78,"name":59,"@type":81,"image":82,"author":87,"headline":59,"publisher":90,"fileFormat":93,"inLanguage":57,"description":61,"dateModified":94,"datePublished":95,"encodingFormat":93,"isAccessibleForFree":96,"interactionStatistic":97},"DigitalDocument",{"url":83,"@type":84,"width":85,"height":86},"https://docshare.wps.com/thumbnails/impacket-exec-commands-cheat-sheet-version-11/572973.png","ImageObject",442,249,{"name":88,"@type":89},"404brain","Person",{"url":68,"name":91,"@type":92},"DocShare","Organization","application/pdf","2026-10-20","2026-10-13",true,{"@type":98,"interactionType":99,"userInteractionCount":76},"InteractionCounter",{"@type":100},"ViewAction",{"@type":102,"mainEntity":103},"FAQPage",[104,110,114],{"name":105,"@type":106,"acceptedAnswer":107},"What does ATEXEC .PY use to run commands, and how are outputs cleaned up?","Question",{"text":108,"@type":109},"ATEXEC .PY requires a command and runs cmd.exe with “/C” followed by the user-specified command, then writes output to a temporary .tmp file under C:\\Windows\\Temp. It subsequently deletes that .tmp file containing the command output.","Answer",{"name":111,"@type":106,"acceptedAnswer":112},"How do DCOMEXEC .PY commands get executed?",{"text":113,"@type":109},"DCOMEXEC can run a specified command or leave it blank for shell. It executes a semi-interactive shell using DCOM objects and requires selecting ShellWindows, ShellBrowserWindow, and MMC20 via the -object parameter.",{"name":115,"@type":106,"acceptedAnswer":116},"Which Impacket tool creates and then removes a Windows Service, and what event IDs are referenced?",{"text":117,"@type":109},"PSEXEC .PY creates and subsequently deletes a Windows Service. It references System event IDs such as 7045 (service installation) and 7036, along with Security event IDs like 4776, 4672, and 4624 Type 3 tied to execution.","https://schema.org",{"og:url":78,"og:type":120,"og:title":59,"og:site_name":91,"og:description":61},"article",{"robots":122,"canonical":78},"index,follow",{"doc_id":124,"site_id":56},572973,1792444030,{"code":4,"msg":5,"data":127},{"doc_id":124,"user_id":128,"nickname":88,"user_avatar":129,"doc_module":9,"category_id":50,"category_name":51,"doc_title":59,"doc_description":61,"doc_content":130,"file_id":131,"file_url":132,"file_type":133,"file_size":134,"view_count":76,"is_deleted":4,"is_public":9,"is_downloadable":9,"audit_status":9,"page_count":47,"language":135,"language_code":57,"site_id":56,"html_lang":57,"table_of_contents":136,"faqs":137,"seo_title":138,"seo_description":61,"update_tm":139,"read_time":73},1099529839291,"https://ap-avatar.wpscdn.com/davatar_6f874abed73319feea01a86fa6f0fab8","Impacket Exec Commands Cheat Sheet  \n ATEXEC .PY  \n[atexec.py](atexec.py) domain/username:password@[hostname | IP] command  \n• Requires a command to execute; shell not available  \n• Creates and subsequently deletes a Scheduled Task with a random 8-character mixed-case alpha string  \n• Runs cmd .exe with arguments of “/C” followed by the command speciﬁed by the user, followed by“C:\\Windows\\Temp\\xxxxxxxx .tmp 2>&1”  \no Where “xxxxxxxx” is the SAME random 8-character mixed-case alpha string used for the Scheduled Task name  \n• Subsequently deletes the .tmp ﬁle containing command output from C:\\Windows\\Temp  \n• NOT detected and blocked by Windows Defender by default  \nWindows Event Log Residue:  \n• Two rounds of:  \no Event ID 4776 in Security on target (for user speciﬁed in command)  \no Event ID 4672 in Security on target (for user speciﬁed in command)  \no Event ID 4624 Type 3 in Security on target (for user speciﬁed in command)  \n• [IF ENABLED] Event ID 4698 in Security on target  \n• Event ID 106, 325, 129, 100, 200, 110, 141, 111, 201, 102 in Microso]-Windows-TaskScheduler/Opera_onal on target  \n• [IF ENABLED] Event ID 4688 in Security on target:  \no svchost .exe à cmd .exe /C command > C:\\Windows\\Temp\\xxxxxxxx .tmp 2>&1  \n• [IF ENABLED] Event ID 4688 in Security on target:  \no cmd .exe à conhost .exe 0xffffffff-ForceV1  \n• [IF ENABLED] Event ID 4699 in Security on target  \n• [IF ENABLED AND EXTERNAL BINARY IS CALLED] Event ID 4688 in Security on target:  \no cmd.exe à xxx.exe (the command speciﬁed via [atexec.py](atexec.py))  \n• Two rounds of:  \no Event ID 4634 Type 3 in Security on target (for user speciﬁed in command)  \n• [IF EXTERNAL BINARY IS CALLED, 201/102 MAY APPEAR LATER] Event ID 201, 102 in Microso]-WindowsTaskScheduler/Opera_onal on target  \nVersion 1.1  \n[youtube.com/13cubed](youtube.com/13cubed)  \nImpacket Exec Commands Cheat Sheet  \n DCOMEXEC .PY  \n[dcomexec.py-object](dcomexec.py-object) [ShellWindows | ShellBrowserWindow | MMC20]  \ndomain/username :password@[hostname | IP] command  \n• Can specify a command to run, or leave blank for shell  \n• Executes a semi-interac_ve shell using DCOM objects  \n• Must specify 'ShellWindows', 'ShellBrowserWindow', 'MMC20 ' via the-object parameter  \n• Uses ﬁrst 5 digits of UNIX Epoch Time in commands  \n• NOT detected and blocked by Windows Defender by default  \nWindows Event Log Residue:  \n• Two rounds of:  \no Event ID 4776 in Security on target (for user speciﬁed in command)  \no Event ID 4672 in Security on target (for user speciﬁed in command)  \no Event ID 4624 Type 3 in Security on target (for user speciﬁed in command)  \n• [IF ENABLED] Event ID 4688 in Security on target:  \no svchost .exe à mmc .exe-Embedding  \n• Event ID 4776 in Security on target (for user speciﬁed in command)  \n• Event ID 4672 in Security on target (for user speciﬁed in command)  \n• Event ID 4624 Type 3 in Security on target (for user speciﬁed in command)  \n• Always present:  \no [IF ENABLED] Event ID 4688 in Security on target:  \nmmc .exe à cmd .exe /Q /c cd \\ 1> \\\\[127.0.0.1](127.0.0.1)\\ADMIN$\\   sssss 2>&1 (where “s” is the ﬁrst 5 digits of the UNIX Epoch Time at which the command ran)  \no [IF ENABLED] Event ID 4688 in Security on target:  \ncmd .exe à conhost .exe 0xffffffff-ForceV1  \no [IF ENABLED] Event ID 4688 in Security on target:  \nmmc .exe à cmd .exe /Q /c cd 1> \\\\[127.0.0.1](127.0.0.1)\\ADMIN$\\   sssss 2>&1  \no [IF ENABLED] Event ID 4688 in Security on target:  \ncmd .exe à conhost .exe 0xffffffff-ForceV1  \n• User speciﬁed commands:  \no [IF ENABLED] Event ID 4688 in Security on target:  \nmmc .exe à cmd .exe /Q /c command 1> \\\\[127.0.0.1](127.0.0.1)\\ADMIN$\\   sssss 2>&1  \no [IF ENABLED] Event ID 4688 in Security on target:  \ncmd .exe à conhost .exe 0xffffffff-ForceV1  \n• Two rounds of:  \no Event ID 4634 Type 3 in Security on target (for user speciﬁed in command)  \nVersion 1.1  \n[youtube.com/13cubed](youtube.com/13cubed)  \nImpacket Exec Commands Cheat Sheet  \n PSEXEC .PY  \n[psexec.py](psexec.py) domai","cbCaipMLLVtcpJjg","https://ap.wps.com/l/cbCaipMLLVtcpJjg","pdf",357455,"English","# ATEXEC .PY\n## Command execution behavior and cleanup\n## Windows Event Log residue\n# DCOMEXEC .PY\n## Command execution behavior\n## Windows Event Log residue\n# PSEXEC .PY\n## Service behavior and Defender notes\n## Windows Event Log residue\n# SMBEXEC .PY","[{\"question\":\"What does ATEXEC .PY use to run commands, and how are outputs cleaned up?\",\"answer\":\"ATEXEC .PY requires a command and runs cmd.exe with “/C” followed by the user-specified command, then writes output to a temporary .tmp file under C:\\\\Windows\\\\Temp. It subsequently deletes that .tmp file containing the command output.\"},{\"question\":\"How do DCOMEXEC .PY commands get executed?\",\"answer\":\"DCOMEXEC can run a specified command or leave it blank for shell. It executes a semi-interactive shell using DCOM objects and requires selecting ShellWindows, ShellBrowserWindow, and MMC20 via the -object parameter.\"},{\"question\":\"Which Impacket tool creates and then removes a Windows Service, and what event IDs are referenced?\",\"answer\":\"PSEXEC .PY creates and subsequently deletes a Windows Service. It references System event IDs such as 7045 (service installation) and 7036, along with Security event IDs like 4776, 4672, and 4624 Type 3 tied to execution.\"}]","Impacket Exec Commands Cheat Sheet - Version 1.1 | PDF",1791930321]