MalCommands

#					tactics	techniques	os

detail

Command Line

net group "Domain Computers" /domain

Description

Retrieve a list of all computer accounts in the active domain. Often used to enumerate devices in an enterprise environment.

Risk

Low

Risk Reason

NET is commonly used to view details about a local or remote user, especially when troubleshooting permission or access issues.

Fidelity

High

Fidelity Reason

Querying all domain computer objects is an extremely common cyber-threat operation and not very likely for normal users to perform frequently - this should be audited.

Operating Systems

windows

Killchain Phases

Actions on Objectives

References

TOOL DATA

Tool Name: net

Tool URL: https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-server-2012-r2-and-2012/cc754340(v=ws.11)#n

Tool Description: Net is an extremely robust utility developed by Microsoft and is commonly used by both IT operators and cyber-threats. It allows for querying of many pieces of environment information as well as configuring, creating or otherwise modifying items such as shares, services, users, etc.

Common Tool Locations

C:\Windows\System32\net.exe
C:\Windows\System32\net1.exe
C:\Windows\SysWOW64\net.exe
C:\Windows\SysWOW64\net1.exe

Common Tool Arguments

localgroup - Discover the members of a specific local group
computer - Add or Delete computers to or from Active Directory.
use - Connect or Disconnect a computer to or from a shared resource.
view - Display a list of domains, computers or resources being shared by the current or specified computer.

MITRE ATT&CK TECHNIQUES

Technique: T1087.002 - Domain Account

URL: https://attack.mitre.org/techniques/T1087/002

Description: Adversaries may attempt to get a listing of domain accounts. This information can help adversaries determine which domain accounts exist to aid in follow-on behavior. Commands such as net user /domain and net group /domain of the [Net](https://attack.mitre.org/software/S0039) utility, dscacheutil -q groupon macOS, and ldapsearch on Linux can list domain users and groups.

Tactics:

Discovery