Windows Network Share Discovery via Net Command

The 'net' command in Windows is a legitimate administrative tool that is frequently abused by threat actors to perform reconnaissance and identify accessible shared resources across a corporate network. By executing 'net view' or 'net use', an attacker can map available network shares on local and remote systems without triggering complex security alerts. This activity is a classic indicator of post-exploitation discovery, often occurring after initial access and prior to data collection or lateral movement. Monitoring process execution patterns for 'net.exe' with specific command-line arguments allows detection engineers to identify unauthorized enumeration attempts. Defenders should focus on normalizing endpoint process telemetry to identify unusual users or unexpected parent processes triggering these commands, while filtering out known administrative service accounts and legitimate automated maintenance scripts.

Attack Chain

1. Attacker gains initial access to a compromised endpoint using a secondary payload or exploit.
2. Attacker establishes a command shell (e.g., cmd.exe or PowerShell) on the endpoint.
3. Attacker executes 'net view \<computername>' to identify available shares on a target system.
4. Attacker executes 'net use' to list current connections or map a network share to a local drive letter.
5. Attacker navigates the mapped shares to locate sensitive files or documents (T1039).
6. Attacker exfiltrates identified data or moves laterally to the target system.

Impact

Successful exploitation leads to the mapping of internal network architecture and unauthorized access to sensitive file shares. This reconnaissance phase is critical for attackers to identify high-value targets for ransomware deployment, intellectual property theft, or escalation of privileges, potentially resulting in large-scale data breaches.

Recommendation

• Deploy the Sigma rule provided in this brief to detect the execution of 'net.exe' with enumeration arguments.
• Enable command-line logging via Sysmon (Event ID 1) or Windows Security Event ID 4688 to capture the full execution context of administrative tools.
• Baseline legitimate administrative usage of 'net' in the environment to create an allowlist filter and reduce false-positive rates.
• Integrate endpoint process logs with a SIEM and map them to the Common Information Model (CIM) to ensure consistent detection logic.