Share And Session Enumeration Using Net.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•13

Detects attempts to enumerate file shares, printer shares, and sessions using the 'net.exe' or 'net1.exe' utility with the 'view' flag. This activity is often performed by adversaries for remote system discovery.