Description
The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility) [Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) using <code>net use</code> commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as <code>net1 user</code>.
External References
Techniques Used by This Tool
- T1007 — System Service Discovery
- T1018 — Remote System Discovery
- T1021.002 — SMB/Windows Admin Shares
- T1049 — System Network Connections Discovery
- T1069.001 — Local Groups
- T1069.002 — Domain Groups
- T1070.005 — Network Share Connection Removal
- T1087.001 — Local Account
- T1087.002 — Domain Account
- T1098.007 — Additional Local or Domain Groups
- T1124 — System Time Discovery
- T1135 — Network Share Discovery
- T1136.001 — Local Account
- T1136.002 — Domain Account
- T1201 — Password Policy Discovery
- T1569.002 — Service Execution