{"id":"f117933c-980c-4f78-b384-e3d838111165","title":"Windows Share Mount Via Net.EXE","description":"Detects when a share is mounted using the \"net.exe\" utility","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"low","date":"2023-02-02","modified":"2023-02-21","tags":["attack.lateral-movement","attack.t1021.002"],"technique_ids":["T1021.002"],"logsource":{"category":"process_creation","product":"windows"},"falsepositives":["Legitimate activity by administrators and scripts"],"references":["https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view"],"source_path":"rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml","source_sha256":"6430573abec3cbd97b58de0656ee9a5ac294983e7ee98ce1a79ef7edc0e8237e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_net_use_mount_share.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Windows Share Mount Via Net.EXE\nid: f117933c-980c-4f78-b384-e3d838111165\nrelated:\n    - id: 3abd6094-7027-475f-9630-8ab9be7b9725\n      type: similar\nstatus: test\ndescription: Detects when a share is mounted using the \"net.exe\" utility\nreferences:\n    - https://drive.google.com/file/d/1lKya3_mLnR3UQuCoiYruO3qgu052_iS_/view\nauthor: Nasreddine Bencherchali (Nextron Systems)\ndate: 2023-02-02\nmodified: 2023-02-21\ntags:\n    - attack.lateral-movement\n    - attack.t1021.002\nlogsource:\n    category: process_creation\n    product: windows\ndetection:\n    selection_img:\n        - Image|endswith:\n              - '\\net.exe'\n              - '\\net1.exe'\n        - OriginalFileName:\n              - 'net.exe'\n              - 'net1.exe'\n    selection_cli:\n        CommandLine|contains:\n            - ' use '\n            - ' \\\\\\\\'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate activity by administrators and scripts\nlevel: low\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1021.002","id":"T1021.002","name":"SMB/Windows Admin Shares","page":"techniques/enterprise/T1021.002/"}],"data_path":"data/detection-rules/f117933c-980c-4f78-b384-e3d838111165.json","kind":"sigma"}