Net
- ID
- S0039
- Type
- Tool
- Associated names
- net.exe
- Platforms
- Windows
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]
Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
Techniques used (16)
- T1007 System Service Discovery
- T1018 Remote System Discovery
- T1021.002 SMB/Windows Admin Shares
- T1049 System Network Connections Discovery
- T1069.001 Local Groups
- T1069.002 Domain Groups
- T1070.005 Network Share Connection Removal
- T1087.001 Local Account
- T1087.002 Domain Account
- T1098.007 Additional Local or Domain Groups
- T1124 System Time Discovery
- T1135 Network Share Discovery
- T1136.001 Local Account
- T1136.002 Domain Account
- T1201 Password Policy Discovery
- T1569.002 Service Execution
Groups using it (33)
- G0004 Ke3chang
- G0006 APT1
- G0007 APT28
- G0009 Deep Panda
- G0010 Turla
- G0016 APT29
- G0018 admin@338
- G0019 Naikon
- G0027 Threat Group-3390
- G0028 Threat Group-1314
- G0034 Sandworm Team
- G0035 Dragonfly
- G0045 menuPass
- G0049 OilRig
- G0050 APT32
- G0059 Magic Hound
- G0060 BRONZE BUTLER
- G0061 FIN8
- G0064 APT33
- G0065 Leviathan
- G0071 Orangeworm
- G0082 APT38
- G0092 TA505
- G0093 GALLIUM
- G0096 APT41
- G0102 Wizard Spider
- G0114 Chimera
- G1017 Volt Typhoon
- G1022 ToddyCat
- G1023 APT5
- G1032 INC Ransom
- G1053 Storm-0501
- G1054 MirrorFace
