title: Windows Network Enumeration
author: Endgame, JHasenbusch (ported for oscd.community)
date: 2018/10/30
description: Identifies attempts to enumerate hosts in a network using the built-in
  Windows net.exe tool.
detection:
  SELECTION_1:
    EventID: 1
  SELECTION_2:
    Image:
    - '*\net.exe'
    - '*\net1.exe'
  SELECTION_3:
    CommandLine: '*view*'
  SELECTION_4:
    CommandLine: '*\\\\*'
  condition: (SELECTION_1 and (SELECTION_2 and SELECTION_3) and  not (SELECTION_4))
falsepositives:
- Legitimate use of net.exe utility by legitimate user
fields:
- ComputerName
- User
- CommandLine
id: 62510e69-616b-4078-b371-847da438cc03
level: low
logsource:
  category: process_creation
  product: windows
modified: 2019/11/11
references:
- https://eqllib.readthedocs.io/en/latest/analytics/b8a94d2f-dc75-4630-9d73-1edc6bd26fff.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1018/T1018.md
status: stable
tags:
- attack.discovery
- attack.t1018