net

System utility to view and modify network-related settings. tldr-pages

On Windows 38 Sigma rules name it 2 sub-commands File net.exe

Windows

Start or stop a Windows service synchronously

net start serviceIdentify

Trips 2 Sigma rules: lowNet.EXE Execution by Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements); lowStart Windows Service Via Net.EXE by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community

Make sure an SMB share is available in the current console

net use \\smb_shared_folder /USER:usernameIdentify

Trips 3 Sigma rules: lowLocal Accounts Discovery by Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community; lowSystem Network Connections Discovery Via Net.EXE by frack113; lowWindows Share Mount Via Net.EXE by Nasreddine Bencherchali (Nextron Systems)

Show the folders currently shared over SMB

net shareIdentify

Trips 1 Sigma rule: lowNet.EXE Execution by Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)

Show who is using your SMB shares (run in elevated console)

net sessionIdentify

Show users in a local security group

net localgroup "Administrators"Identify

Trips 1 Sigma rule: lowNet.EXE Execution by Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)

Add a user to the local security group (run in elevated console)

net localgroup "Administrators" username /addIdentify

Trips 2 Sigma rules: mediumNew User Created Via Net.EXE by Endgame, JHasenbusch (adapted to Sigma for oscd.community); lowNet.EXE Execution by Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements)

Display help for a subcommand

net help subcommandIdentify

Display help

net helpIdentify

What detects it

Sigma process creation rules that name net

criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)

criticalRorschach Ransomware Execution ActivityX__Junior (Nextron Systems)

criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)

highDarkGate - User Created Via Net.EXEX__Junior (Nextron Systems)

highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)

highNew User Created Via Net.EXE With Never Expire OptionNasreddine Bencherchali (Nextron Systems)

highPotential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Groupfrack113

highPotential Process Injection Via Msra.EXEAlexander McDonald

highPotential Ryuk Ransomware ActivityFlorian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)

highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)

highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)

highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)

highSuspicious Manipulation Of Default Accounts Via Net.EXENasreddine Bencherchali (Nextron Systems)

highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)

highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth

highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)

highSuspicious Windows Service TamperingNasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)

highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson

highWindows Internet Hosted WebDav Share Mount Via Net.EXENasreddine Bencherchali (Nextron Systems)

highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali

mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)

mediumNew User Created Via Net.EXEEndgame, JHasenbusch (adapted to Sigma for oscd.community)

mediumPassword Provided In Command Line Of Net.EXETim Shelton (HAWK.IO)

mediumPotential Defense Evasion Via Binary RenameMatthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)

mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)

mediumRemote Access Tool - ScreenConnect Potential Suspicious Remote Command ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems), @Kostastsale

mediumSMB over QUIC Via Net.EXEfrack113

mediumSuspicious Group And Account Reconnaissance Activity Using Net.EXEFlorian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems)

mediumWindows Admin Share Mount Via Net.EXEoscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga

lowDiscovery of a System TimeE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

And 8 more rules that name net.

Sub-commands

each with its page

net printnet user