System Network Connections Discovery Via Net.EXE
Last updated on:
In this page
About the rule
Rule Type
Standard
Rule Description
Adversaries may attempt to get a listing of network connections to or from the compromised system they are currently accessing or from remote systems by querying for information over the network.
Severity
Attention
Rule Requirement
Criteria
Action1: actionname = "Process started" AND (PROCESSNAME endswith "\net.exe,\net1.exe" OR ORIGINALFILENAME = "net.exe,net1.exe") AND (COMMANDLINE endswith " use, sessions" OR COMMANDLINE contains " use , sessions ") select Action1.HOSTNAME,Action1.MESSAGE,Action1.COMMANDLINE,Action1.FILE_NAME,Action1.PROCESSNAME,Action1.USERNAME,Action1.PARENTPROCESSNAME
Detection
Execution Mode
realtime
Log Sources
Windows
Author
frack113
