1. Home
  2. Software
  3. Net

Net

The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]

Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.

ID: S0039
ⓘ
Associated Software: net.exe
ⓘ
Type: TOOL
ⓘ
Platforms: Windows
Contributors: David Ferguson, CyberSponse
Version: 2.8
Created: 31 May 2017
Last Modified: 12 May 2026
Version Permalink
Enterprise Layer
download view

Techniques Used

Domain ID Name Use
Enterprise T1087 .001 Account Discovery: Local Account

Commands under net user can be used in Net to gather information about and manipulate user accounts.[2]
.002 Account Discovery: Domain Account

Net commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.[3]
Enterprise T1098 .007 Account Manipulation: Additional Local or Domain Groups

The net localgroup and net group commands in Net can be used to add existing users to local and domain groups.[4] [5]
Enterprise T1136 .001 Create Account: Local Account

The net user username \password commands in Net can be used to create a local account.[2]
.002 Create Account: Domain Account

The net user username \password \domain commands in Net can be used to create a domain account.[2]
Enterprise T1070 .005 Indicator Removal: Network Share Connection Removal

The net use \system\share /delete command can be used in Net to remove an established connection to a network share.[6]
Enterprise T1135 Network Share Discovery

The net view \remotesystem and net share commands in Net can be used to find shared drives and directories on remote and local systems respectively.[2]
Enterprise T1201 Password Policy Discovery

The net accounts and net accounts /domain commands with Net can be used to obtain password policy information.[2]
Enterprise T1069 .001 Permission Groups Discovery: Local Groups

Commands such as net group and net localgroup can be used in Net to gather information about and manipulate groups.[2]
.002 Permission Groups Discovery: Domain Groups

Commands such as net group /domain can be used in Net to gather information about and manipulate groups.[2]
Enterprise T1021 .002 Remote Services: SMB/Windows Admin Shares

Lateral movement can be done with Net through net use commands to connect to the on remote systems.[2]
Enterprise T1018 Remote System Discovery

Commands such as net view can be used in Net to gather information about available remote systems.[2]
Enterprise T1049 System Network Connections Discovery

Commands such as net use and net session can be used in Net to gather information about network connections from a particular host.[2]
Enterprise T1007 System Service Discovery

The net start command can be used in Net to find information about Windows services.[2]
Enterprise T1569 .002 System Services: Service Execution

The net start and net stop commands can be used in Net to execute or stop Windows services.[2]
Enterprise T1124 System Time Discovery

The net time command can be used in Net to determine the local or remote system time.[7]

Groups That Use This Software

ID Name References
G0082 APT38

[8]
G0093 GALLIUM

[9]
G0018 admin@338

[10]
G1017 Volt Typhoon

[11][12]
G0096 APT41

[13]
G0035 Dragonfly

[14]
G0045 menuPass

[15]
G0050 APT32

[16]
G0019 Naikon

[17][18]
G0034 Sandworm Team

[19]
G0049 OilRig

[20][21][22]
G0071 Orangeworm

[23]
G0004 Ke3chang

[24][25]
G0006 APT1

[26]
G0065 Leviathan

[27]
G0010 Turla

[28]
G1053 Storm-0501

Storm-0501 has used the Net utility on the Windows operating system.[29][30]
G0092 TA505

[31]
G0016 APT29

[32]
G0114 Chimera

[33]
G1054 MirrorFace

[34]
G0060 BRONZE BUTLER

[35]
G0009 Deep Panda

[36]
G1022 ToddyCat

[37]
G0007 APT28

[38]
G1023 APT5

[39]
G1032 INC Ransom

[40]
G0028 Threat Group-1314

[41]
G0102 Wizard Spider

[42][43][44][45][46][47][48][49]
G0059 Magic Hound

[50][51]
G0027 Threat Group-3390

[52]
G0064 APT33

[53]
G0061 FIN8

[54]

Campaigns

ID Name Description
C0026 C0026

[55]

References

  1. Microsoft. (2006, October 18). Net.exe Utility. Retrieved September 22, 2015.
  2. Savill, J. (1999, March 4). Net.exe reference. Retrieved September 22, 2015.
  3. Microsoft. (2017, February 14). Net Commands On Windows Operating Systems. Retrieved March 19, 2020.
  4. Microsoft. (2016, August 31). Net Localgroup. Retrieved August 5, 2024.
  5. Microsoft. (2016, August 31). Net group. Retrieved August 5, 2024.
  6. Microsoft. (n.d.). Net Use. Retrieved November 25, 2016.
  7. Microsoft. (n.d.). Net time. Retrieved November 25, 2016.
  8. FireEye. (2018, October 03). APT38: Un-usual Suspects. Retrieved November 17, 2024.
  9. Cybereason Nocturnus. (2019, June 25). Operation Soft Cell: A Worldwide Campaign Against Telecommunications Providers. Retrieved July 18, 2019.
  10. FireEye Threat Intelligence. (2015, December 1). China-based Cyber Threat Group Uses Dropbox for Malware Communications and Targets Hong Kong Media Outlets. Retrieved December 4, 2015.
  11. Counter Threat Unit Research Team. (2023, May 24). Chinese Cyberespionage Group BRONZE SILHOUETTE Targets U.S. Government and Defense Organizations. Retrieved July 27, 2023.
  12. CISA et al.. (2024, February 7). PRC State-Sponsored Actors Compromise and Maintain Persistent Access to U.S. Critical Infrastructure. Retrieved May 15, 2024.
  13. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019.
  14. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018.
  15. PwC and BAE Systems. (2017, April). Operation Cloud Hopper: Technical Annex. Retrieved April 13, 2017.
  16. Dahan, A. (2017). Operation Cobalt Kitty. Retrieved December 27, 2018.
  17. Baumgartner, K., Golovkin, M.. (2015, May). The MsnMM Campaigns: The Earliest Naikon APT Campaigns. Retrieved April 10, 2019.
  18. Vrabie, V. (2021, April 23). NAIKON – Traces from a Military Cyber-Espionage Operation. Retrieved June 29, 2021.
  19. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020.
  20. Falcone, R. and Lee, B.. (2016, May 26). The OilRig Campaign: Attacks on Saudi Arabian Organizations Deliver Helminth Backdoor. Retrieved May 3, 2017.
  21. Sardiwal, M, et al. (2017, December 7). New Targeted Attack in the Middle East by APT34, a Suspected Iranian Threat Group, Using CVE-2017-11882 Exploit. Retrieved December 20, 2017.
  22. Symantec Threat Hunter Team. (2023, October 19). Crambus: New Campaign Targets Middle Eastern Government. Retrieved November 27, 2024.
  23. Symantec Security Response Attack Investigation Team. (2018, April 23). New Orangeworm attack group targets the healthcare sector in the U.S., Europe, and Asia. Retrieved May 8, 2018.
  24. Villeneuve, N., Bennett, J. T., Moran, N., Haq, T., Scott, M., & Geers, K. (2014). OPERATION “KE3CHANG”: Targeted Attacks Against Ministries of Foreign Affairs. Retrieved November 12, 2014.
  25. Smallridge, R. (2018, March 10). APT15 is alive and strong: An analysis of RoyalCli and RoyalDNS. Retrieved April 4, 2018.
  26. Mandiant. (n.d.). APT1 Exposing One of China’s Cyber Espionage Units. Retrieved July 18, 2016.
  27. Plan, F., et al. (2019, March 4). APT40: Examining a China-Nexus Espionage Actor. Retrieved March 18, 2019.
  28. Kaspersky Lab's Global Research and Analysis Team. (2014, August 7). The Epic Turla Operation: Solving some of the mysteries of Snake/Uroburos. Retrieved December 11, 2014.
  1. Microsoft Threat Intelligence. (2024, September 26). Storm-0501: Ransomware attacks expanding to hybrid cloud environments. Retrieved October 19, 2025.
  2. Microsoft Threat Intelligence. (2025, August 27). Storm-0501’s evolving techniques lead to cloud-based ransomware. Retrieved October 19, 2025.
  3. Hiroaki, H. and Lu, L. (2019, June 12). Shifting Tactics: Breaking Down TA505 Group’s Use of HTML, RATs and Other Techniques in Latest Campaigns. Retrieved May 29, 2020.
  4. CISA. (2020, July 16). MAR-10296782-1.v1 – SOREFANG. Retrieved September 29, 2020.
  5. Jansen, W . (2021, January 12). Abusing cloud services to fly under the radar. Retrieved September 12, 2024.
  6. Tomonaga, S. (2024, July 16). MirrorFace Attack against Japanese Organisations. Retrieved April 17, 2026.
  7. Counter Threat Unit Research Team. (2017, October 12). BRONZE BUTLER Targets Japanese Enterprises. Retrieved January 4, 2018.
  8. Alperovitch, D. (2014, July 7). Deep in Thought: Chinese Targeting of National Security Think Tanks. Retrieved November 12, 2014.
  9. Dedola, G. et al. (2023, October 12). ToddyCat: Keep calm and check logs. Retrieved January 3, 2024.
  10. NSA, CISA, FBI, NCSC. (2021, July). Russian GRU Conducting Global Brute Force Campaign to Compromise Enterprise and Cloud Environments. Retrieved July 26, 2021.
  11. Perez, D. et al. (2021, May 27). Re-Checking Your Pulse: Updates on Chinese APT Actors Compromising Pulse Secure VPN Devices. Retrieved February 5, 2024.
  12. Carvey, H. (2024, May 1). LOLBin to INC Ransomware. Retrieved June 5, 2024.
  13. Dell SecureWorks Counter Threat Unit Special Operations Team. (2015, May 28). Living off the Land. Retrieved January 26, 2016.
  14. Hanel, A. (2019, January 10). Big Game Hunting with Ryuk: Another Lucrative Targeted Ransomware. Retrieved May 12, 2020.
  15. Brian Donohue, Katie Nickels, Paul Michaud, Adina Bodkins, Taylor Chapman, Tony Lambert, Jeff Felling, Kyle Rainey, Mike Haag, Matt Graeber, Aaron Didier.. (2020, October 29). A Bazar start: How one hospital thwarted a Ryuk ransomware outbreak. Retrieved October 30, 2020.
  16. Kimberly Goody, Jeremy Kennelly, Joshua Shilko, Steve Elovitz, Douglas Bienstock. (2020, October 28). Unhappy Hour Special: KEGTAP and SINGLEMALT With a Ransomware Chaser. Retrieved October 28, 2020.
  17. The DFIR Report. (2020, October 8). Ryuk’s Return. Retrieved October 9, 2020.
  18. The DFIR Report. (2020, November 5). Ryuk Speed Run, 2 Hours to Ransom. Retrieved November 6, 2020.
  19. The DFIR Report. (2020, October 18). Ryuk in 5 Hours. Retrieved October 19, 2020.
  20. Sean Gallagher, Peter Mackenzie, Elida Leite, Syed Shahram, Bill Kearney, Anand Aijan, Sivagnanam Gn, Suraj Mundalik. (2020, October 14). They’re back: inside a new Ryuk ransomware attack. Retrieved October 14, 2020.
  21. Shilko, J., et al. (2021, October 7). FIN12: The Prolific Ransomware Intrusion Threat Actor That Has Aggressively Pursued Healthcare Targets. Retrieved June 15, 2023.
  22. DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022.
  23. DFIR Report. (2021, November 15). Exchange Exploit Leads to Domain Wide Ransomware. Retrieved January 5, 2023.
  24. Counter Threat Unit Research Team. (2017, June 27). BRONZE UNION Cyberespionage Persists Despite Disclosures. Retrieved July 13, 2017.
  25. Security Response attack Investigation Team. (2019, March 27). Elfin: Relentless Espionage Group Targets Multiple Organizations in Saudi Arabia and U.S.. Retrieved April 10, 2019.
  26. Elovitz, S. & Ahl, I. (2016, August 18). Know Your Enemy: New Financially-Motivated & Spear-Phishing Group. Retrieved February 26, 2018.
  27. Hawley, S. et al. (2023, February 2). Turla: A Galaxy of Opportunity. Retrieved May 15, 2023.