Impacket
- ID
- S0357
- Type
- Tool
- Platforms
- Linux, macOS, Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Impacket is an open source collection of modules written in Python for programmatically constructing and manipulating network protocols. Impacket contains several tools for remote service execution, Kerberos manipulation, Windows credential dumping, packet sniffing, and relay attacks.[1]
Techniques used (11)
- T1003.001 LSASS Memory
- T1003.002 Security Account Manager
- T1003.003 NTDS
- T1003.004 LSA Secrets
- T1040 Network Sniffing
- T1047 Windows Management Instrumentation
- T1557.001 Name Resolution Poisoning and SMB Relay
- T1558.003 Kerberoasting
- T1558.005 Ccache Files
- T1569.002 Service Execution
- T1570 Lateral Tool Transfer
Groups using it (18)
- G0016 APT29
- G0027 Threat Group-3390
- G0030 Lotus Blossom
- G0034 Sandworm Team
- G0035 Dragonfly
- G0045 menuPass
- G0059 Magic Hound
- G0061 FIN8
- G0096 APT41
- G0125 HAFNIUM
- G0129 Mustang Panda
- G1003 Ember Bear
- G1016 FIN13
- G1017 Volt Typhoon
- G1021 Cinnamon Tempest
- G1046 Storm-1811
- G1047 Velvet Ant
- G1053 Storm-0501