System Network Connections Discovery via Net.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•15

This rule detects attempts to discover network connections on a system using the built-in Windows `net.exe` or `net1.exe` utility with the `use` or `sessions` commands. Adversaries often use these commands to map out network resources and active user sessions on compromised systems.