Windows Process Creation: net.exe or net1.exe Execution

title: "Windows Process Creation: net.exe or net1.exe Execution"
id: 187c433e-534a-4710-974b-f535d5d2c977
status: test
description: This rule flags Windows process creation events where the executable image ends with net.exe or net1.exe, or where the OriginalFileName is net.exe or net1.exe. It further narrows matches to command lines containing common net utility subcommands such as accounts, group, localgroup, share, start, stop, user, and view. Attackers often use the net utility for discovery and basic system/service interaction, so monitoring for these specific invocations can highlight suspicious administrative activity. The detection relies on process creation telemetry including Image and OriginalFileName fields and the CommandLine content.
references:
  - https://pentest.blog/windows-privilege-escalation-methods-for-pentesters/
  - https://eqllib.readthedocs.io/en/latest/analytics/4d2e7fc1-af0b-4915-89aa-03d25ba7805e.html
  - https://eqllib.readthedocs.io/en/latest/analytics/e61f557c-a9d0-4c25-ab5b-bbc46bb24deb.html
  - https://eqllib.readthedocs.io/en/latest/analytics/9b3dd402-891c-4c4d-a662-28947168ce61.html
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1007/T1007.md#atomic-test-2---system-service-discovery---netexe
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_net_execution.yml
author: Michael Haag, Mark Woan (improvements), James Pemberton / @4A616D6573 / oscd.community (improvements), Huntrule Team
date: 2019-01-16
modified: 2022-07-11
tags:
  - attack.discovery
  - attack.t1007
  - attack.t1049
  - attack.t1018
  - attack.t1135
  - attack.t1201
  - attack.t1069.001
  - attack.t1069.002
  - attack.t1087.001
  - attack.t1087.002
  - attack.lateral-movement
  - attack.t1021.002
  - attack.s0039
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith:
        - \net.exe
        - \net1.exe
    - OriginalFileName:
        - net.exe
        - net1.exe
  selection_cli:
    CommandLine|contains:
      - " accounts"
      - " group"
      - " localgroup"
      - " share"
      - " start"
      - " stop "
      - " user"
      - " view"
  condition: all of selection_*
falsepositives:
  - Likely
level: low
license: DRL-1.1
related:
  - id: 183e7ea8-ac4b-4c23-9aec-b3dac4e401ac
    type: derived