net.exe

net.exe runs the family of net sub-commands: net user and net group for accounts, net localgroup for local groups, net share and net view for shares, net use to connect to a remote share, net session, net accounts, and net start / net stop for services. For many of these, net.exe does not do the work itself: it relaunches a second binary, net1.exe, which carries out the operation. A net1.exe running as a child of net.exe is therefore normal, not a sign of tampering. Both live in C:\Windows\System32.

net is run constantly and legitimately by administrators, logon scripts, and management tooling, so the process itself is unremarkable. What separates routine use from abuse is the specific sub-command, its arguments, and the parent. An interactive admin session running net use looks nothing like an Office document spawning net group "domain admins" /domain.

net.exe is the go-to reconnaissance tool right after access (T1087.002, T1069.002, T1135). net user /domain and net group "domain admins" /domain enumerate accounts and high-value groups, net localgroup administrators lists local admins, and net view and net share map reachable shares. A burst of these soon after a process starts, particularly under an unusual parent, is classic situational-awareness activity on a freshly accessed host.

It also drives lateral movement (T1021.002). net use \\target\C$ /user:domain\admin mounts a remote admin share with stolen credentials, the foothold for staging tools or copying data. Connections to hosts a user has no reason to touch deserve a closer look.

Finally, net creates and empowers accounts (T1136.001). net user /add makes a new local account and net localgroup administrators <user> /add grants it admin, a simple and durable persistence and privilege move. Because every one of these is a legitimate administrative command, the sub-command and the context, not the binary, are what matter. Watch net1.exe as well: net.exe forwards most work to it, so calling it directly sidesteps any rule that only inspects net.exe.