H3XAOperational intelligence
Live analytical pictureEvidence before assessment
TypeTool
External ID—
First seen2026-08-14
Last seen2026-08-14

Confidence

—

The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility) [Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user .

Labels

tool
50 recorded

Relationships

usesGroup
uses
from APT1
Group
uses
from APT28
Group
uses
from APT29
Group
uses
from APT32
Group
uses
from APT33
Group
uses
from APT38
Group
uses
from APT41
Group
uses
from APT5
Group
usesGroup
uses
from C0026
Campaign
uses
from Chimera
Group
usesGroup
usesGroup
uses
from FIN8
Group
uses
from GALLIUM
Group
usesGroup
usesGroup
usesGroup
usesGroup
usesGroup
usesGroup
uses
from Naikon
Group
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
usesTechnique
uses
from OilRig
Group
usesGroup
usesGroup
usesGroup
uses
from TA505
Group
usesGroup
usesGroup
usesGroup
uses
from Turla
Group
usesGroup
usesGroup
3 external

References

mitre-attack
S0039
open
Microsoft Net Utility
https://msdn.microsoft.com/en-us/library/aa939914
open
Savill 1999
https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference
open