ATT&CKProcedure examples

Procedure examples

Real-world descriptions of how a group, tool or campaign used a technique.

Software: S0039×

16 examples

Technique	Used by	Procedure example
T1007 System Service Discovery	ToolNet	The `net start` command can be used in Net to find information about Windows services. Savill 1999
T1018 Remote System Discovery	ToolNet	Commands such as `net view` can be used in Net to gather information about available remote systems. Savill 1999
T1021.002 SMB/Windows Admin Shares	ToolNet	Lateral movement can be done with Net through `net use` commands to connect to the on remote systems. Savill 1999
T1049 System Network Connections Discovery	ToolNet	Commands such as `net use` and `net session` can be used in Net to gather information about network connections from a particular host. Savill 1999
T1069.001 Local Groups	ToolNet	Commands such as `net group` and `net localgroup` can be used in Net to gather information about and manipulate groups. Savill 1999
T1069.002 Domain Groups	ToolNet	Commands such as `net group /domain` can be used in Net to gather information about and manipulate groups. Savill 1999
T1070.005 Network Share Connection Removal	ToolNet	The `net use \\system\share /delete` command can be used in Net to remove an established connection to a network share. Technet Net Use
T1087.001 Local Account	ToolNet	Commands under `net user` can be used in Net to gather information about and manipulate user accounts. Savill 1999
T1087.002 Domain Account	ToolNet	Net commands used with the `/domain` flag can be used to gather information about and manipulate user accounts on the current domain. Microsoft Net
T1098.007 Additional Local or Domain Groups	ToolNet	The `net localgroup` and `net group` commands in Net can be used to add existing users to local and domain groups. Microsoft Net Group Microsoft Net Localgroup
T1124 System Time Discovery	ToolNet	The `net time` command can be used in Net to determine the local or remote system time. TechNet Net Time
T1135 Network Share Discovery	ToolNet	The `net view \\remotesystem` and `net share` commands in Net can be used to find shared drives and directories on remote and local systems respectively. Savill 1999
T1136.001 Local Account	ToolNet	The `net user username \password` commands in Net can be used to create a local account. Savill 1999
T1136.002 Domain Account	ToolNet	The `net user username \password \domain` commands in Net can be used to create a domain account. Savill 1999
T1201 Password Policy Discovery	ToolNet	The `net accounts` and `net accounts /domain` commands with Net can be used to obtain password policy information. Savill 1999
T1569.002 Service Execution	ToolNet	The `net start` and `net stop` commands can be used in Net to execute or stop Windows services. Savill 1999

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.