CmdID / Files

net.exe

Net Command file version info

Program on Windows 12 known copies with hashes 41 Sigma rules name it Command net

Is it the real net.exe?

file version info and known copies

Installed inC:\Windows\system32\
C:\Windows\SysWOW64\

Signed byMicrosoft Windows

ProductMicrosoft Windows Operating System, Microsoft Corporation

DescriptionNet Command

12 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\net.exe · signed by Microsoft Windows

4aa3ee22f801d722ec1c52c38f844dcee8406865375bedf5b1876f9b259d0ad5

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\net.exe · signed by Microsoft Windows

6485ad188540e7f1f90246bec13424d71aa0cfa286c519e352d5c1e66df6dbad

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\net.exe · signed by Microsoft Windows

7c4c7725e266f12aba8c50fd1598d4001201bca0e7aca901508307e365afff42

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\net.exe · signed by Microsoft Windows

9f376759bcbcd705f726460fc4a7e2b07f310f52baa73caaaaa124fddbdf993e

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\net.exe · signed by Microsoft Windows

96cdfd7b263947a6a7c0db54141a6b8d7777db0a03a17cbf95666d98422f937b

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\net.exe · signed by Microsoft Windows

a0d28f866a78ee1bfe0cf40a9713078856f9f39258ad34e5d6e6d9227beb1f56

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\net.exe · signed by Microsoft Windows

1fb73d95bd75dcc9734c2586e8d9c5eea74706786d6ad71523ffc8799817348f

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\net.exe · signed by Microsoft Windows

25c8266d2bc1d5626dcdf72419838b397d28d44d00ac09f02ff4e421b43ec369

10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810) · C:\Windows\SysWOW64\net.exe · signed by Microsoft Windows

42c289e1f976730a0325c0d1a293437502bef55935f08f258f81b89cf59abd25

10.0.14393.2430 (rs1_release_inmarket_aim.180806-1810) · C:\Windows\system32\net.exe · signed by Microsoft Windows

fddc5f29f779a6ef73d70a2c551397fdee63f549f2bce4fe6a7aeedc11f4f72e

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\net.exe · not signed

4b487075f31cfca0a480b2c8be0d265655298f26e95b00f132285c784b3da4eb

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\net.exe · not signed

b331b2ce9418ffaf3a759b3889db1777f1848ffd9954689c6fa25fd6ffc43834

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name net.exe

criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)

criticalRorschach Ransomware Execution ActivityX__Junior (Nextron Systems)

criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)

highDarkGate - User Created Via Net.EXEX__Junior (Nextron Systems)

highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)

highNew User Created Via Net.EXE With Never Expire OptionNasreddine Bencherchali (Nextron Systems)

highPotential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Groupfrack113

highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar

highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)

highPotential Process Injection Via Msra.EXEAlexander McDonald

highPotential Ryuk Ransomware ActivityFlorian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)

highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)

highSuspicious Manipulation Of Default Accounts Via Net.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

highSuspicious Windows Service TamperingNasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)

highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson

highWindows Internet Hosted WebDav Share Mount Via Net.EXENasreddine Bencherchali (Nextron Systems)

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)

mediumNew User Created Via Net.EXEEndgame, JHasenbusch (adapted to Sigma for oscd.community)

mediumPassword Provided In Command Line Of Net.EXETim Shelton (HAWK.IO)

mediumPotential Defense Evasion Via Binary RenameMatthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)

mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)

mediumRemote Access Tool - ScreenConnect Potential Suspicious Remote Command ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale

mediumSMB over QUIC Via Net.EXEfrack113

mediumSuspicious Group And Account Reconnaissance Activity Using Net.EXEFlorian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems)

And 10 more process creation rules that name net.exe.

Sigma names net.exe in 41 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.