Detect net view used to enumerate hosts and shares on the network

Siemphony@siemphonylowT1018verified in labPlaybook · Discovery and enumeration

Matches Sysmon process creation where the executing image is net.exe or its net1.exe helper and the argument string carries the view verb, which is the one single-event form of remote system discovery in AN1583 that means only enumeration. The analytic is really about bursts — enumeration utilities run in short succession, MITRE's TimeWindow knob suggesting under thirty seconds — and Sigma expresses neither succession nor count, so this rule fires on one invocation and cannot tell a burst from a single command. ping.exe and tracert.exe are deliberately left out for the same reason: outside a correlation window a single ping carries no discovery signal and would swamp the rule. The verb is anchored to the image on purpose; matching the string net view against a bare command line collides with any path or argument that happens to contain it. Detection needs Sysmon EventID 1 installed with a config that does not exclude net.exe, which volume-trimmed configs often do. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0574, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

1title: Detect net view used to enumerate hosts and shares on the network2id: 1a1af100-7265-4c78-8554-7fc2c45743213status: experimental4description: |5  Matches Sysmon process creation where the executing image is net.exe or its6  net1.exe helper and the argument string carries the view verb, which is the7  one single-event form of remote system discovery in AN1583 that means only8  enumeration. The analytic is really about bursts — enumeration utilities run9  in short succession, MITRE's TimeWindow knob suggesting under thirty seconds —10  and Sigma expresses neither succession nor count, so this rule fires on one11  invocation and cannot tell a burst from a single command. ping.exe and12  tracert.exe are deliberately left out for the same reason: outside a13  correlation window a single ping carries no discovery signal and would swamp14  the rule. The verb is anchored to the image on purpose; matching the string15  net view against a bare command line collides with any path or argument that16  happens to contain it. Detection needs Sysmon EventID 1 installed with a17  config that does not exclude net.exe, which volume-trimmed configs often do.18  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0574, not hand-written and not tested by its author. Any lab result is on this rule's own page.19references:20  - https://attack.mitre.org/techniques/T101821  - https://attack.mitre.org/detectionstrategies/DET057422author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)23date: 2026-08-1624tags:25  - attack.discovery26  - attack.t101827logsource:28  category: process_creation29  product: windows30detection:31  selection_image:32    Image|endswith:33      - '\net.exe'34      - '\net1.exe'35  selection_verb:36    CommandLine|contains: ' view'37  condition: selection_image and selection_verb38falsepositives:39  - "Routine administration. Helpdesk and infrastructure staff run net view to find a host or check which shares a server is publishing, and it is a standard first move when diagnosing a mapped-drive complaint. This is the rule's dominant source of hits in any environment with hands-on admins, and it is why the level is set low rather than high."40  - "Logon scripts, drive-mapping batch files and legacy scripted installers that probe for a file server before mapping it, which produce one hit per user per logon from every workstation and can be the single largest contributor to volume."41  - "Inventory, backup and software-distribution agents that shell out to net view to enumerate shares on a target, appearing on a fixed schedule from a small set of service accounts. MITRE's CommandLinePattern knob is where such tooling is excluded; MITRE names SCCM and PsExec as the examples."42  - "The rule cannot distinguish a lone administrative net view from the same command issued as part of an enumeration burst, because the analytic's TimeWindow element has no Sigma equivalent. Treat a hit as a lead to pivot on the host and account, not as a finding on its own."43level: low

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\net.exe" or FolderPath endswith "\\net1.exe") and ProcessCommandLine contains " view")

Splunk · SPL

Run this as a search.

index=* ((Image="*\\net.exe" OR Image="*\\net1.exe") AND CommandLine="* view*")

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\net.exe" OR TO_LOWER(process.executable) LIKE "*\\\\net1.exe") AND TO_LOWER(process.command_line) LIKE "* view*")

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\net\.exe$|\\net1\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) view</field>    <description>Detect net view used to enumerate hosts and shares on the network</description>    <mitre>      <id>T1018</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: discovery_recon
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 1a1af100-7265-4c78-8554-7fc2c4574321

ATT&CKT1018

T1018Remote System Discovery

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Evidence

Verification2 runs

Verified in Siemphony lab

Security Datasets — Remote system discovery
passed
Siemphony IR · 3 Sept 2026
2 true · 0 false · 0.0% noise
Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1018, evaluated against their process_creation events.

Using it

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Fix the boundary first — a one-line change that removes false positives and loses no true ones. Then decide this rule's lane against T1135: require /domain here, or repoint it at an observable T1135 does not own (nltest, the arp cache, the hosts file).
MITRE's CommandLinePattern knob is where scripted tooling gets excluded, with SCCM and PsExec as MITRE's examples. The ParentProcess knob is the better use of your time — MITRE's own example is Word.exe spawning net.exe, which turns a low-value discovery hit into something worth waking up for. TimeWindow has no Sigma form; the burst logic belongs in your correlation layer.
level: low is correct, and the rule says why: a lead to pivot on, not a finding.

Declared by the author

Routine administration. Helpdesk and infrastructure staff run net view to find a host or check which shares a server is publishing, and it is a standard first move when diagnosing a mapped-drive complaint. This is the rule's dominant source of hits in any environment with hands-on admins, and it is why the level is set low rather than high.
Logon scripts, drive-mapping batch files and legacy scripted installers that probe for a file server before mapping it, which produce one hit per user per logon from every workstation and can be the single largest contributor to volume.
Inventory, backup and software-distribution agents that shell out to net view to enumerate shares on a target, appearing on a fixed schedule from a small set of service accounts. MITRE's CommandLinePattern knob is where such tooling is excluded; MITRE names SCCM and PsExec as the examples.
The rule cannot distinguish a lone administrative net view from the same command issued as part of an enumeration burst, because the analytic's TimeWindow element has no Sigma equivalent. Treat a hit as a lead to pivot on the host and account, not as a finding on its own.

Lessondiscovery recon

discovery reconAI draft — unreviewed

01 · What this rule detects

net.exe or net1.exe executed with an argument string containing the word view — the one single-event form of remote system discovery in AN1583 that means enumeration and nothing else. AN1583 is not about a command; it is about a burst — "execution of network enumeration utilities in short succession", with the TimeWindow knob suggesting under thirty seconds. Sigma expresses neither succession nor count, so this rule fires on one invocation and cannot tell a burst from an administrator typing one command. That is why ping.exe and tracert.exe are deliberately left out: outside a correlation window a single ping carries no signal and would swamp everything else.

02 · Telemetry you need

Sysmon EventID 1, with a config that does not exclude net.exe —
Security 4688, which the Sentinel translation actually renders against,

03 · How the logic works

The image gate is anchored properly: endswith with a leading backslash forces a path separator before the filename, so mynet.exe does not match. The verb gate is where the teaching is. contains: ' view' is an unanchored substring — a leading space stops it matching overview mid-word, and there is no trailing boundary at all. So it also matches:

Those are T1069 Permission Groups Discovery and T1087 Account Discovery, not remote system discovery, and in any AD estate with human-named groups they are not rare. The rule's description claims "the verb is anchored to the image on purpose" to avoid collisions. That anchoring is real — but the collision happens inside the argument string, which nothing anchors. Two different anchoring problems; solving one does not solve the other. The trap worth internalising: a substring match on a word is not a match on a command verb. ' view ' with a trailing space plus an endswith: ' view' alternative, or a re modifier with a word boundary, costs nothing and removes the whole class. Two coverage boundaries follow. This rule sits almost inside the corpus's T1135 rule, which already matches net view on CommandLine — so every net view fires both, giving two technique tags for one process. The separating observable exists and is unused: net view /domain enumerates hosts (T1018) while net view \\host enumerates that host's shares (T1135). And net view has itself been broken by the retirement of Computer Browser and SMBv1; operators use nltest /dclist:, arp -a and Get-ADComputer, none of which this rule sees.

04 · Common false positives

Helpdesk and infrastructure staff — net view is a standard first move on a
Logon scripts and drive-mapping batch files probing for a file server before
Inventory, backup and software-distribution agents on a fixed schedule.
The substring collisions above, which the review names as the highest-volume

05 · Detection maturity

tier_1: .** UNVERIFIED — derived from MITRE ATT&CK DET0574 and never executed against logs.
tier_2: run it over a week of historical data, count how many hits are the view collision rather than the verb, and confirm CommandLine is populated at all.
tier_3: is the burst — net view joined to other enumeration commands from the same account inside MITRE's TimeWindow — which is the analytic as written, and lives entirely outside Sigma.

Related detections6 nearby

Ranked by how alike the detection logic reads, computed offline. Proximity is not evidence — each of these carries its own verification state on its own page.

Share this rule

/u/siemphony/1a1af100-7265-4c78-8554-7fc2c4574321

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Detect net view used to enumerate hosts and shares on the network

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it