---
id: 3155
title: "Dissecting Impacket for Good and Bad"
source_domain: abdulmhsblog.com
source_url: "http://abdulmhsblog.com/posts/impacket-iocs/"
published_at: "2026-05-10 00:00"
tags: ["active-directory", "kerberos", "smb", "red-team", "blue-team", "detection", "ioc", "impacket", "network-forensics"]
phying_url: "https://phying.com/item/3155"
lang: en
---

# Dissecting Impacket for Good and Bad

## Summary

Rewriting Impacket internally led the author to publish Impacket-IoCs, 72+ protocol-level detection indicators, after finding most public detections rely on easily changed service names and artifacts.

## Intelligence Metadata

- **Sources:** abdulmhsblog.com
- **Published:** 2026-05-10 00:00
- **Original:** http://abdulmhsblog.com/posts/impacket-iocs/
- **Phying News:** https://phying.com/item/3155