CmdID

CmdID / Files

net1.exe

Net Command file version info

Program on Windows 16 known copies with hashes 39 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

Is it the real net1.exe?

file version info and known copies
Installed inC:\Windows\system32\
C:\Windows\SysWOW64\
Signed byMicrosoft Windows
ProductMicrosoft Windows Operating System, Microsoft Corporation
DescriptionNet Command

16 known copies

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\net1.exe · signed by Microsoft Windows

517cfc40ddeb8a94fa6f0db4f7b5cf5c25bc3b72d598198addd6b7eca52997b0

10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\net1.exe · signed by Microsoft Windows

af78e8384cda8ef04a661bfa8cd3b557a2d952e2830573f3d2dc7266fc4c0e7e

10.0.19041.844 (WinBuild.160101.0800) · C:\Windows\SysWOW64\net1.exe · signed by Microsoft Windows

0d150f5b9102dc65b71336d49d4f534324434efa2a8ce627a9da30c84343f486

10.0.19041.844 (WinBuild.160101.0800) · C:\Windows\system32\net1.exe · signed by Microsoft Windows

253e6148ec7a95ea3950e032f9def1ec7c0e0cd172cc6d770d2807a64fc4a7ca

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\SysWOW64\net1.exe · signed by Microsoft Windows

964722d4207cdf6c2419212e101b453a7c6dafd3b65ac9205aaea4d38c5514e4

10.0.19041.546 (WinBuild.160101.0800) · C:\Windows\system32\net1.exe · signed by Microsoft Windows

f4cbb5284b2d0334a1f65060cbfff1e382ca7a0c35e6bd4031710f301ff9816b

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\net1.exe · signed by Microsoft Windows

13a5af915f7520e998fc4e8760a7068b1a70aba90652d9f53f8740b466b9024d

10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\net1.exe · signed by Microsoft Windows

386a5632f4ce064a2d07ceeb30486c0cb7c85d63df31bb055eb392fc0fba3e46

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\net1.exe · signed by Microsoft Windows

286e7f127b06386bd1cc9664851848f483a867f0f604aa352893151068715faa

10.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\net1.exe · signed by Microsoft Windows

912fc9a2d5b52831c9c70643deab9726ec25c06e01aade69fe844f4ba653ac7a

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\net1.exe · signed by Microsoft Windows

383ecc5dbcdd98163c556ca6e4486c5dc6a35c3f1cff88dcf12da2cdaba80970

10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\net1.exe · signed by Microsoft Windows

c687157fd58eaa51757cda87d06c30953a31f03f5356b9f5a9c004fa4bad4bf5

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\net1.exe · signed by Microsoft Windows

756f45004c4e80b3d3b9a1695ada3f0c46efede53a16ea29e5c8ae7dd2b568de

10.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\net1.exe · signed by Microsoft Windows

e92a2fa67ad2f7367aba1abf237d245b5e36291c5a4a9f0fc04b3a0e32ff618e

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\SysWOW64\net1.exe · not signed

01579b7ac743f18645c1ac3ca8b3dbe0de0e20b7fbb98ed0c302903e8488e0be

6.3.9600.17415 (winblue_r4.141028-1500) · C:\windows\system32\net1.exe · not signed

d28bc8fa6e80316833c0ebb948b46511971b96635892f40998a216a2dd5ec8aa

From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.

What detects it

Sigma process creation rules that name net1.exe
criticalPotential Dridex ActivityFlorian Roth (Nextron Systems), oscd.community, Nasreddine Bencherchali (Nextron Systems)
criticalRorschach Ransomware Execution ActivityX__Junior (Nextron Systems)
criticalSuspicious Child Process Of Veeam DabataseNasreddine Bencherchali (Nextron Systems)
highDarkGate - User Created Via Net.EXEX__Junior (Nextron Systems)
highExploited CVE-2020-10189 Zoho ManageEngineFlorian Roth (Nextron Systems)
highNew User Created Via Net.EXE With Never Expire OptionNasreddine Bencherchali (Nextron Systems)
highPotential Exploitation of CVE-2024-37085 - Suspicious Creation Of ESX Admins Groupfrack113
highPotential Exploitation of CrushFTP RCE Vulnerability (CVE-2025-54309)Nisarg Suthar
highPotential Exploitation of GoAnywhere MFT VulnerabilityMSFT (idea), Swachchhanda Shrawan Poudel (Nextron Systems)
highPotential Ryuk Ransomware ActivityFlorian Roth (Nextron Systems), Vasiliy Burov, Nasreddine Bencherchali (Nextron Systems)
highPotentially Suspicious Child Process Of Regsvr32elhoim, Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
highSuspicious Child Process Of Manage Engine ServiceDeskFlorian Roth (Nextron Systems)
highSuspicious Child Process Of Wermgr.EXEFlorian Roth (Nextron Systems)
highSuspicious Manipulation Of Default Accounts Via Net.EXENasreddine Bencherchali (Nextron Systems)
highSuspicious Process By Web Server ProcessThomas Patzke, Florian Roth (Nextron Systems), Zach Stanford @svch0st, Tim Shelton, Nasreddine Bencherchali (Nextron Systems)
highSuspicious Processes Spawned by Java.EXEAndreas Hunkeler (@Karneades), Florian Roth
highSuspicious Spool Service Child ProcessJustin C. (@endisphotic), @dreadphones (detection), Thomas Patzke (Sigma rule)
highSuspicious Windows Service TamperingNasreddine Bencherchali (Nextron Systems), frack113 , X__Junior (Nextron Systems)
highWebshell Detection With Command Line KeywordsFlorian Roth (Nextron Systems), Jonhnathan Ribeiro, Anton Kutepov, oscd.community, Chad Hudson, Matt Anderson
highWindows Internet Hosted WebDav Share Mount Via Net.EXENasreddine Bencherchali (Nextron Systems)
highWindows Suspicious Child Process from Node.js - React2ShellSwachchhanda Shrawan Poudel (Nextron Systems), Nasreddine Bencherchali
mediumFile or Folder Permissions ModificationsJakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
mediumNew User Created Via Net.EXEEndgame, JHasenbusch (adapted to Sigma for oscd.community)
mediumPassword Provided In Command Line Of Net.EXETim Shelton (HAWK.IO)
mediumPotential Defense Evasion Via Binary RenameMatthew Green @mgreen27, Ecco, James Pemberton @4A616D6573, oscd.community, Andreas Hunkeler (@Karneades)
mediumPotentially Suspicious Child Process Of ClickOnce ApplicationNasreddine Bencherchali (Nextron Systems)
mediumSMB over QUIC Via Net.EXEfrack113
mediumSuspicious Group And Account Reconnaissance Activity Using Net.EXEFlorian Roth (Nextron Systems), omkar72, @svch0st, Nasreddine Bencherchali (Nextron Systems)
mediumWindows Admin Share Mount Via Net.EXEoscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga
lowDiscovery of a System TimeE.M. Anhaus (originally from Atomic Blue Detections, Endgame), oscd.community

And 8 more process creation rules that name net1.exe.

Sigma names net1.exe in 39 rules in all, for every kind of event; these are the process creation rules CmdID evaluates.