Windows net.exe Uses QUIC Transport to Mount SMB Shares

Alerts on net.exe commands mounting SMB shares over QUIC transport (/TRANSPORT:QUIC), using process creation logs.

FreeReviewedSigma · Medium · v5

Product: windows
Category: process_creation
Author: frack113 (SigmaHQ), DRL 1.1
Published: 2023-07-21
Updated: 2026-07-31

ATT&CK techniques

Lateral Movement

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
- T1570Lateral Tool Transfer
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process execution where net.exe (or net1.exe) is launched with a /TRANSPORT:QUIC parameter, indicating SMB share access over QUIC. Attackers may use this to blend lateral movement or alter expected network transport behavior, making it important to flag this as potentially unexpected in enterprise environments. It relies on Windows process creation telemetry, specifically the process image name and the command line containing the QUIC transport switch.

Reporting behind it

Related detections9 linkedT1570 — drag to rearrange

Suspicious Ransomware Fan-Out Deployment via PsExec Spread (Qilin)

Chisel Reverse Tunnel Tool Execution from Temporary Directory

BITS Payload Downloaded via Commandline (via process_creation)

BITS Payload Downloaded via PowerShell (via powershell)

Malicious regsvcs LOLBin Loading Ransomware DLL from UNC Path

Suspicious SMB DLL Lateral Movement

Malicious Remote Process Execution From an SMB Admin Share (via process_creation)

Suspicious Python Execution from WebDAV Share via PowerShell (via process_creation)

Suspicious PsExec Copying Payload To Windows Temp (via process_creation)

Windows net.exe Uses QUIC Transport to Mount SMB Shares

Pivot detection · T1570 · 9 related

Changelog

v5
Candidate ingested via manual entry.2026-07-31
v4
Candidate ingested via manual entry.2026-07-31
v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-net-exe-mounting-smb-over-quic-via-transport-quic-2238d337

title: Windows net.exe Uses QUIC Transport to Mount SMB Shares
id: 80803b83-2a6d-4ce1-9c65-ad19487e5d95
related:
  - id: 6df07c3b-8456-4f8b-87bb-fe31ec964cae
    type: similar
  - id: 2238d337-42fb-4971-9a68-63570f2aede4
    type: derived
status: test
description: This rule identifies process execution where net.exe (or net1.exe) is launched with a /TRANSPORT:QUIC parameter, indicating SMB share access over QUIC. Attackers may use this to blend lateral movement or alter expected network transport behavior, making it important to flag this as potentially unexpected in enterprise environments. It relies on Windows process creation telemetry, specifically the process image name and the command line containing the QUIC transport switch.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/74438b0237d141ee9c99747976447dc884cb1a39/atomics/T1570/T1570.md
  - https://www.trustedsec.com/blog/making-smb-accessible-with-ntlmquic/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_net_quic.yml
author: frack113, Huntrule Team
date: 2023-07-21
tags:
  - attack.lateral-movement
  - attack.t1570
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    CommandLine|contains: /TRANSPORT:QUIC
  condition: all of selection_*
falsepositives:
  - Administrative activity
level: medium
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL