CC moving-laterally-with-netexec

| T1021.002 | Remote Services: SMB/Windows Admin Shares | Lateral Movement | NetExec authenticates to `ADMIN$`/`C$` and runs code on remote hosts |

| T1110.003 | Brute Force: Password Spraying | Credential Access | `--continue-on-success` sprays one password across many accounts |

| T1003.002 | OS Credential Dumping: Security Account Manager | Credential Access | `--sam` extracts local account hashes |

| T1003.004 | OS Credential Dumping: LSA Secrets | Credential Access | `--lsa` extracts LSA secrets and cached domain creds |

| T1003.006 | OS Credential Dumping: DCSync | Credential Access | `--ntds` replicates the domain database via DRSUAPI |

description: Use NetExec (nxc) to validate credentials, enumerate SMB shares/users/policy, password-spray safely across lockout thresholds, execute commands, and dump SAM/LSA/NTDS credentials across S

> **Authorized Use Only:** This skill is for authorized penetration testing, red-team engagements, and educational labs only. NetExec authenticates to, executes code on, and extracts credentials from 

For lateral movement specifically, NetExec maps directly to MITRE ATT&CK **T1021.002 (Remote Services: SMB/Windows Admin Shares)**: it authenticates over SMB (port 445), reaches `ADMIN$`/`C$`, and use

- During an internal network penetration test after obtaining one or more valid credentials/hashes, to identify every host where those credentials grant admin access.

- To perform controlled password spraying against a domain while respecting lockout thresholds.