Net — Malware Profile
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. Net has a great deal of functionality, much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
MITRE ATT&CK techniques (16)
- T1007 System Service Discovery
- T1018 Remote System Discovery
- T1021.002 SMB/Windows Admin Shares
- T1049 System Network Connections Discovery
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1070.005 Network Share Connection Removal
- T1087.001 Local Account
- T1087.002 Domain Account
- T1098.007 Additional Local or Domain Groups
- T1124 System Time Discovery
- T1135 Network Share Discovery
- T1136.001 Local Account
- T1136.002 Domain Account
- T1201 Password Policy Discovery
- T1569.002 Service Execution