List Rare Net(1).exe Parameter Executions

Rare Net Paramater Executions

Query

let StartTime = 30d;
let RareThresholdNetActionType = 10; // Determine how rare a command must be to be included in the results
let RareNetParameters = DeviceProcessEvents
    | where Timestamp > startofday(ago(StartTime))
    | where FileName in ("net.exe", "net1.exe")
    | extend NetActionType = case(ProcessCommandLine has "accounts", "ACCOUNTS", 
        ProcessCommandLine has "computer", "COMPUTER", 
        ProcessCommandLine has "config", "CONFIG", 
        ProcessCommandLine has "continue", "CONTINUE", 
        ProcessCommandLine has "file", "FILE", 
        ProcessCommandLine has "group", "GROUP", 
        ProcessCommandLine has "help", "HELP", 
        ProcessCommandLine has "helpmsg", "HELPMSG", 
        ProcessCommandLine has "localgroup", "LOCALGROUP", 
        ProcessCommandLine has "pause", "PAUSE", 
        ProcessCommandLine has "session", "SESSION", 
        ProcessCommandLine has "share", "SHARE", 
        ProcessCommandLine has "start", "START", 
        ProcessCommandLine has "statistics", "STATISTICS", 
        ProcessCommandLine has "stop", "STOP", 
        ProcessCommandLine has "time", "TIME", 
        ProcessCommandLine has "use", "USE", 
        ProcessCommandLine has "user", "USER", 
        ProcessCommandLine has "view", "VIEW", "Else")
    | summarize TotalCommands = count() by NetActionType
    | where TotalCommands <= RareThresholdNetActionType
    | distinct NetActionType;
DeviceProcessEvents
| where Timestamp > startofday(ago(StartTime))
| where FileName in ("net.exe", "net1.exe")
| extend NetActionType = case(ProcessCommandLine has "accounts", "ACCOUNTS", 
        ProcessCommandLine has "computer", "COMPUTER", 
        ProcessCommandLine has "config", "CONFIG", 
        ProcessCommandLine has "continue", "CONTINUE", 
        ProcessCommandLine has "file", "FILE", 
        ProcessCommandLine has "group", "GROUP", 
        ProcessCommandLine has "help", "HELP", 
        ProcessCommandLine has "helpmsg", "HELPMSG", 
        ProcessCommandLine has "localgroup", "LOCALGROUP", 
        ProcessCommandLine has "pause", "PAUSE", 
        ProcessCommandLine has "session", "SESSION", 
        ProcessCommandLine has "share", "SHARE", 
        ProcessCommandLine has "start", "START", 
        ProcessCommandLine has "statistics", "STATISTICS", 
        ProcessCommandLine has "stop", "STOP", 
        ProcessCommandLine has "time", "TIME", 
        ProcessCommandLine has "use", "USE", 
        ProcessCommandLine has "user", "USER", 
        ProcessCommandLine has "view", "VIEW", "Else")
| where NetActionType in (RareNetParameters)
| project-reorder Timestamp, AccountUpn, ProcessCommandLine

About this query

Explanation

This query is designed to identify and list rare uses of specific parameters with the net.exe or net1.exe commands in your environment. Here's a simplified breakdown of what the query does:

Time Frame: It looks at command executions within the last 30 days by default.
Command Filtering: It specifically focuses on executions of net.exe or net1.exe, which are Windows command-line utilities used for network-related tasks.
Parameter Identification: The query checks for specific parameters used with these commands. These parameters include options like ACCOUNTS, COMPUTER, CONFIG, etc., which are part of the command's syntax.
Rarity Threshold: It determines which parameters are rarely used by setting a threshold (default is 10). If a parameter is used 10 times or less within the specified time frame, it is considered rare.
Output: The query outputs a list of these rare parameters along with the command lines that were executed, helping to identify unusual or potentially suspicious activity.
Risk Context: The rationale is that adversaries might exploit rarely used parameters to avoid detection, so identifying these can help in spotting potential security threats.

In essence, this query helps security analysts detect unusual command-line activity that might indicate malicious behavior.

Details

Bert-Jan Pals

Released: October 20, 2024

Tables

DeviceProcessEvents

Keywords

DeviceProcessEventsFileNameCommandLineAccountUpnTimeGeneratedTimestampNetActionTypeTotalCommands

Operators

letinextendcasehassummarizecountbywheredistinctproject-reorder

Actions

GitHub

KQL Search