1200kmSECURITY RESEARCH
Loading interactive filters…

1200KM / tool

Net — Attack Tool

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. Net has a great deal of functionality, much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

Tool identity and evidence

Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.

Aliases: Net, net.exe

Primary tool reference

Existing author guides

No reviewed association in this snapshot.

Primary documentation

No reviewed association in this snapshot.

Connected ecosystem references

Linked tags

cloudcloud-hosted-endpointcontainersidentitynetwork-infrastructureonpremsaasvirtualizationWindows
attack_toolattack_uses

Documented actor use

Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.

Technique-specific simulations and detections

Detection links describe the associated behavior, not independently verified tool-specific signatures.

Telemetry context

Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.