MITRE ATT&CKsoftware (tool)
S0039 Net
- Domain
- enterprise
- Platforms
- Windows
- Aliases
- net.exe
- Version
- 2.8
- Created
- 2017-05-31
Description
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections.
Net has a great deal of functionality, much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
Related
Uses · MITRE ATT&CK (16)
- T1098.007 Additional Local or Domain Groups sub-technique
- T1069.001 Local Groups sub-technique
- T1569.002 Service Execution sub-technique
- T1069.002 Domain Groups sub-technique
- T1087.001 Local Account sub-technique
- T1087.002 Domain Account sub-technique
- T1021.002 SMB/Windows Admin Shares sub-technique
- T1070.005 Network Share Connection Removal sub-technique
- T1136.001 Local Account sub-technique
- T1136.002 Domain Account sub-technique
- T1201 Password Policy Discovery technique
- T1135 Network Share Discovery technique
- T1007 System Service Discovery technique
- T1018 Remote System Discovery technique
- T1049 System Network Connections Discovery technique
- T1124 System Time Discovery technique
Referenced by MITRE ATT&CK · uses (34)
- G1054 MirrorFace group
- G1053 Storm-0501 group
- G1032 INC Ransom group
- G1023 APT5 group
- G1022 ToddyCat group
- G1017 Volt Typhoon group
- C0026 C0026 campaign
- G0114 Chimera group
- G0102 Wizard Spider group
- G0096 APT41 group
- G0093 GALLIUM group
- G0092 TA505 group
- G0082 APT38 group
- G0071 Orangeworm group
- G0061 FIN8 group
- G0064 APT33 group
- G0065 Leviathan group
- G0059 Magic Hound group
- G0060 BRONZE BUTLER group
- G0049 OilRig group
- G0050 APT32 group
- G0004 Ke3chang group
- G0006 APT1 group
- G0007 APT28 group
- G0009 Deep Panda group
- G0010 Turla group
- G0016 APT29 group
- G0018 admin@338 group
- G0019 Naikon group
- G0027 Threat Group-3390 group