{"description": "Enterprise techniques used by Net, ATT&CK software S0039 (v2.7)", "name": "Net (S0039)", "domain": "enterprise-attack", "versions": {"layer": "4.5", "attack": "17", "navigator": "5.1.0"}, "techniques": [{"techniqueID": "T1087", "showSubtechniques": true}, {"techniqueID": "T1087.001", "comment": "Commands under net user can be used in [Net](https://attack.mitre.org/software/S0039) to gather information about and manipulate user accounts.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1087.002", "comment": "[Net](https://attack.mitre.org/software/S0039) commands used with the /domain flag can be used to gather information about and manipulate user accounts on the current domain.(Citation: Microsoft Net)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1098", "showSubtechniques": true}, {"techniqueID": "T1098.007", "comment": "The `net localgroup` and `net group` commands in [Net](https://attack.mitre.org/software/S0039) can be used to add existing users to local and domain groups.(Citation: Microsoft Net Localgroup) (Citation: Microsoft Net Group)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1136", "showSubtechniques": true}, {"techniqueID": "T1136.001", "comment": "The net user username \\password commands in [Net](https://attack.mitre.org/software/S0039) can be used to create a local account.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1136.002", "comment": "The net user username \\password \\domain commands in [Net](https://attack.mitre.org/software/S0039) can be used to create a domain account.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1070", "showSubtechniques": true}, {"techniqueID": "T1070.005", "comment": "The net use \\\\system\\share /delete command can be used in [Net](https://attack.mitre.org/software/S0039) to remove an established connection to a network share.(Citation: Technet Net Use)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1135", "comment": "The net view \\\\remotesystem and net share commands in [Net](https://attack.mitre.org/software/S0039) can be used to find shared drives and directories on remote and local systems respectively.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1201", "comment": "The net accounts and net accounts /domain commands with [Net](https://attack.mitre.org/software/S0039) can be used to obtain password policy information.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1069", "showSubtechniques": true}, {"techniqueID": "T1069.001", "comment": "Commands such as net group and net localgroup can be used in [Net](https://attack.mitre.org/software/S0039) to gather information about and manipulate groups.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1069.002", "comment": "Commands such as net group /domain can be used in [Net](https://attack.mitre.org/software/S0039) to gather information about and manipulate groups.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1021", "showSubtechniques": true}, {"techniqueID": "T1021.002", "comment": "Lateral movement can be done with [Net](https://attack.mitre.org/software/S0039) through net use commands to connect to the on remote systems.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1018", "comment": "Commands such as net view can be used in [Net](https://attack.mitre.org/software/S0039) to gather information about available remote systems.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1049", "comment": "Commands such as net use and net session can be used in [Net](https://attack.mitre.org/software/S0039) to gather information about network connections from a particular host.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1007", "comment": "The net start command can be used in [Net](https://attack.mitre.org/software/S0039) to find information about Windows services.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}, {"techniqueID": "T1569", "showSubtechniques": true}, {"techniqueID": "T1569.002", "comment": "The net start and net stop commands can be used in [Net](https://attack.mitre.org/software/S0039) to execute or stop Windows services.(Citation: Savill 1999)", "score": 1, "color": "#66b1ff", "showSubtechniques": true}, {"techniqueID": "T1124", "comment": "The net time command can be used in [Net](https://attack.mitre.org/software/S0039) to determine the local or remote system time.(Citation: TechNet Net Time)", "score": 1, "color": "#66b1ff", "showSubtechniques": false}], "gradient": {"colors": ["#ffffff", "#66b1ff"], "minValue": 0, "maxValue": 1}, "legendItems": [{"label": "used by Net", "color": "#66b1ff"}]}