Windows net.exe Mounting SMB over QUIC via /TRANSPORT:QUIC

title: Windows net.exe Mounting SMB over QUIC via /TRANSPORT:QUIC
id: 80803b83-2a6d-4ce1-9c65-ad19487e5d95
related:
  - id: 6df07c3b-8456-4f8b-87bb-fe31ec964cae
    type: similar
  - id: 2238d337-42fb-4971-9a68-63570f2aede4
    type: derived
status: test
description: This rule flags process executions of Windows net.exe (or net1.exe) where the command line includes /TRANSPORT:QUIC, indicating SMB share access using QUIC transport. Attackers may leverage unexpected SMB-over-QUIC behavior to move laterally or blend into environments where standard SMB transport is not typically used. It relies on Windows process creation telemetry, matching the image name and the presence of the QUIC transport option in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1570/T1570.md
  - https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_net_quic.yml
author: frack113, Huntrule Team
date: 2023-07-21
tags:
  - attack.lateral-movement
  - attack.t1570
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    CommandLine|contains: /TRANSPORT:QUIC
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1