H3XA — Operational Evidence

TypeTool

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

[CrackMapExec](https://attack.mitre.org/software/S0488), or CME, is a post-exploitation tool developed in Python and designed for penetration testing against networks. [CrackMapExec](https://attack.mitre.org/software/S0488) collects Active Directory information to conduct lateral movement through targeted networks.(Citation: CME Github September 2018)

Labels

tool

26 recorded

Relationships

uses

from APT39

Group

uses

to At

Technique

uses

Technique

uses

to Domain Account

Technique

uses

to Domain Groups

Technique

uses

to File and Directory Discovery

Technique

uses

to Local Storage Discovery

Technique

uses

Technique

uses

to Modify Registry

Technique

uses

to Network Share Discovery

Technique

uses

Technique

uses

to Pass the Hash

Technique

uses

to Password Guessing

Technique

uses

to Password Policy Discovery

Technique

uses

to Password Spraying

Technique

uses

Technique

uses

to Remote System Discovery

Technique

uses

to Security Account Manager

Technique

uses

to System Network Configuration Discovery

Technique

uses

to System Network Connections Discovery

Technique

uses

to Windows Management Instrumentation

Technique

uses

from Cutting Edge

Campaign

uses

Group

uses

from Ember Bear

Group

uses

from FIN7

Group

uses

from MuddyWater

Group

2 external

References

mitre-attack

S0488

CME Github September 2018

https://github.com/byt3bl33d3r/CrackMapExec/wiki/SMB-Command-Reference