Windows: net.exe used to start a service with the start flag

Identifies Windows processes using net.exe/net1.exe with ' start ' to start services.

FreeUnreviewedSigmalowv1

windows-net-exe-used-to-start-a-service-with-the-start-flag-2a072a96

title: "Windows: net.exe used to start a service with the start flag"
id: 8d3b7347-e66b-45f7-803c-7f688beef6d4
status: test
description: This rule flags process executions where net.exe or net1.exe is invoked with a command line containing the start keyword followed by a space, indicating a service start operation. Attackers often use built-in command utilities like net.exe to execute service-related actions without writing custom tooling. It relies on process creation telemetry, matching the executable name/path and the presence of the ' start ' token in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1569.002/T1569.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_net_start_service.yml
author: Timur Zinniatullin, Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2019-10-21
modified: 2023-03-05
tags:
  - attack.execution
  - attack.t1569.002
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    CommandLine|contains: " start "
  condition: all of selection_*
falsepositives:
  - Legitimate administrator or user executes a service for legitimate reasons.
level: low
license: DRL-1.1
related:
  - id: 2a072a96-a086-49fa-bcb5-15cc5a619093
    type: derived

What it detects

This rule flags process executions where net.exe or net1.exe is invoked with a command line containing the start keyword followed by a space, indicating a service start operation. Attackers often use built-in command utilities like net.exe to execute service-related actions without writing custom tooling. It relies on process creation telemetry, matching the executable name/path and the presence of the ' start ' token in the command line.

Known false positives

Legitimate administrator or user executes a service for legitimate reasons.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.