Windows Net.exe Network Connections Discovery via Use Sessions Query
Flags net.exe/net1.exe commands using 'use sessions' to enumerate network connection/session information.
- Product
- windows
- Category
- process_creation
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-10
- Updated
- 2026-07-30
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process execution of net.exe or net1.exe where the command line includes the 'use' and 'sessions' options, indicating discovery of network connections involving current or remote systems. Adversaries use this to enumerate session-related network activity and identify potential targets on accessible systems. It relies on Windows process creation telemetry, including the executable name/path and the full command line.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Net.exe Network Connections Discovery via Use Sessions Query
id: 7c951e6a-f574-4a6f-ac0b-611112b080f2
status: test
description: This rule identifies process execution of net.exe or net1.exe where the command line includes the 'use' and 'sessions' options, indicating discovery of network connections involving current or remote systems. Adversaries use this to enumerate session-related network activity and identify potential targets on accessible systems. It relies on Windows process creation telemetry, including the executable name/path and the full command line.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_use_network_connections_discovery.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-02-21
tags:
- attack.discovery
- attack.t1049
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith:
- \net.exe
- \net1.exe
- OriginalFileName:
- net.exe
- net1.exe
selection_cli:
- CommandLine|endswith:
- " use"
- " sessions"
- CommandLine|contains:
- " use "
- " sessions "
condition: all of selection_*
falsepositives:
- Unknown
level: low
license: DRL-1.1
related:
- id: 1c67a717-32ba-409b-a45d-0fb704a73a81
type: derived