Windows Net.exe Network Connections Discovery via Use Sessions Query

title: Windows Net.exe Network Connections Discovery via Use Sessions Query
id: 7c951e6a-f574-4a6f-ac0b-611112b080f2
status: test
description: This rule identifies process execution of net.exe or net1.exe where the command line includes the 'use' and 'sessions' options, indicating discovery of network connections involving current or remote systems. Adversaries use this to enumerate session-related network activity and identify potential targets on accessible systems. It relies on Windows process creation telemetry, including the executable name/path and the full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-02-21
tags:
  - attack.discovery
  - attack.t1049
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    - CommandLine|endswith:
        - " use"
        - " sessions"
    - CommandLine|contains:
        - " use "
        - " sessions "
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: 1c67a717-32ba-409b-a45d-0fb704a73a81
    type: derived