Windows Admin Share Mount Via Net.EXE

Title: Windows Admin Share Mount Via Net.EXE
Status: test
Description:Detects when an admin share is mounted using net.exe
References:
  -https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view
Author: oscd.community, Teymur Kheirkhabarov @HeirhabarovT, Zach Stanford @svch0st, wagga
Date: 2020-10-05
modified:2023-02-21
Tags:

• -'attack.lateral-movement'
• -'attack.t1021.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    - OriginalFileName:
      - 'net.exe'
      - 'net1.exe'
  selection_cli:
    CommandLine|contains|all:
      -' use '
      -' \\\\*\\*$'

  condition:all of selection_*
Falsepositives:
  -Administrators
Level: medium