System Network Connections Discovery Via Net.EXE

Title: System Network Connections Discovery Via Net.EXE
Status: test
Description:Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md#atomic-test-1---system-network-connections-discovery
Author: frack113
Date: 2021-12-10
modified:2023-02-21
Tags:

• -'attack.discovery'
• -'attack.t1049'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection_img:
    - Image|endswith:
      - '\net.exe'
      - '\net1.exe'
    - OriginalFileName:
      - 'net.exe'
      - 'net1.exe'
  selection_cli:
    - CommandLine|endswith:
      - ' use'
      - ' sessions'
    - CommandLine|contains:
      - ' use '
      - ' sessions '
  condition:all of selection_*
Falsepositives:
  -Unknown
Level: low