CmdID / Rules / Windows

Net.EXE Execution

A Sigma rule for process creation on Windows, from SigmaHQ’s threat hunting rules, by Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements).

low 10 ATT&CK techniques 3 programs it names 10 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it

detection:
  selection_cli:
    CommandLine|contains:
      - ' accounts'
      - ' group'
      - ' localgroup'
      - ' share'
      - ' start'
      - ' stop '
      - ' user'
      - ' view'
  selection_img:
    - Image|endswith:
        - '\net.exe'
        - '\net1.exe'
    - OriginalFileName:
        - 'net.exe'
        - 'net1.exe'
  condition: all of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Start or stop a Windows service synchronously on the page for net

net start serviceIdentify

Show the folders currently shared over SMB on the page for net

net shareIdentify

Show users in a local security group on the page for net

net localgroup "Administrators"Identify

Add a user to the local security group (run in elevated console) on the page for net

net localgroup "Administrators" username /addIdentify

To display a list of all user accounts for the local computer, run the following command on the page for net user

net userIdentify

To display information about the user account TommyH, run the following command on the page for net user

net user tommyhIdentify

To add a user account for Jay Samson (user name: jays), with sign in rights from 8 AM to 5 PM, Monday through Friday, with the mandatory password Cyk4^g3B, and use the user's full name, run the following command on the page for net user

net user jays Cyk4^g3B /add /passwordreq:yes /times:monday-friday,8am-5pm /fullname:"Jay Jamison"Identify

To set the sign-in time from 8 AM to 5 PM for the username MikeD using 24-hour notation, run the following command on the page for net user

net user miked /time:M-F,08:00-17:00Identify

To set the sign-in time from 8 AM to 5 PM for MikeD using 12-hour notation, run the following command on the page for net user

net user miked /time:M-F,8AM-5PMIdentify

To specify sign-in hours of 4 AM to 12 PM on Monday, 12 PM to 8 PM on Tuesday, and 8 AM to 5 PM Wednesday through Friday for username AnibalS, run the following command on the page for net user

net user anibals /time:M,4AM-12PM;T,12PM-8PM;W-F,8AM-5PMIdentify

Programs and files it names

their pages here

netnet.exenet1.exe

ATT&CK

the techniques it is tagged with

T1007System Service Discovery

T1018Remote System Discovery

T1021.002Remote Services: SMB/Windows Admin Shares

T1049System Network Connections Discovery

T1069.001Permission Groups Discovery: Local Groups

T1069.002Permission Groups Discovery: Domain Groups

T1087.001Account Discovery: Local Account

T1087.002Account Discovery: Domain Account

T1135Network Share Discovery

T1201Password Policy Discovery

Net.EXE Execution

What it looks for

Command lines that trip it

Programs and files it names

ATT&CK

Other rules for T1007 System Service Discovery