The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections.
Net has a great deal of functionality, much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
| Technique | Procedure example |
|---|---|
| T1007 System Service Discovery |
The |
| T1018 Remote System Discovery |
Commands such as |
| T1021.002 SMB/Windows Admin Shares |
Lateral movement can be done with Net through |
| T1049 System Network Connections Discovery |
Commands such as |
| T1069.001 Local Groups |
Commands such as |
| T1069.002 Domain Groups |
Commands such as |
| T1070.005 Network Share Connection Removal |
The |
| T1087.001 Local Account |
Commands under |
| T1087.002 Domain Account |
Net commands used with the |
| T1098.007 Additional Local or Domain Groups |
The `net localgroup` and `net group` commands in Net can be used to add existing users to local and domain groups. |
| T1124 System Time Discovery |
The |
| T1135 Network Share Discovery |
The |
| T1136.001 Local Account |
The |
| T1136.002 Domain Account |
The |
| T1201 Password Policy Discovery |
The |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
