ATT&CK ReferencesSavill 1999

Savill 1999

Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.

Open the source

Techniques1

T1136.002Domain Account

Groups0

None recorded.

Software1

Campaigns0

None recorded.

Procedure examples12

Technique	Used by	Procedure example
T1007 System Service Discovery	ToolNet	The `net start` command can be used in Net to find information about Windows services. Savill 1999
T1018 Remote System Discovery	ToolNet	Commands such as `net view` can be used in Net to gather information about available remote systems. Savill 1999
T1021.002 SMB/Windows Admin Shares	ToolNet	Lateral movement can be done with Net through `net use` commands to connect to the on remote systems. Savill 1999
T1049 System Network Connections Discovery	ToolNet	Commands such as `net use` and `net session` can be used in Net to gather information about network connections from a particular host. Savill 1999
T1069.001 Local Groups	ToolNet	Commands such as `net group` and `net localgroup` can be used in Net to gather information about and manipulate groups. Savill 1999
T1069.002 Domain Groups	ToolNet	Commands such as `net group /domain` can be used in Net to gather information about and manipulate groups. Savill 1999
T1087.001 Local Account	ToolNet	Commands under `net user` can be used in Net to gather information about and manipulate user accounts. Savill 1999
T1135 Network Share Discovery	ToolNet	The `net view \\remotesystem` and `net share` commands in Net can be used to find shared drives and directories on remote and local systems respectively. Savill 1999
T1136.001 Local Account	ToolNet	The `net user username \password` commands in Net can be used to create a local account. Savill 1999
T1136.002 Domain Account	ToolNet	The `net user username \password \domain` commands in Net can be used to create a domain account. Savill 1999
T1201 Password Policy Discovery	ToolNet	The `net accounts` and `net accounts /domain` commands with Net can be used to obtain password policy information. Savill 1999
T1569.002 Service Execution	ToolNet	The `net start` and `net stop` commands can be used in Net to execute or stop Windows services. Savill 1999

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.