A net.exe connection to a remote resource was started by · win.eventdata.commandLine = (?i)use\s

Description

A net.exe connection to a remote resource was started by $(win.eventdata.parentImage)

Query · wazuh

field win.eventdata.commandLine="(?i)use\s"

Fires when

Wazuh evaluates a chain top-down. Every rule above this one must match on the same event before this rule is tested at all.

  1. 92031 Discovery activity executed anchor level 3
    field win.eventdata.originalFileName="(?i)(net\.EXE|net1\.EXE)"
  2. 92037 A net.exe connection to a remote resource was started by · win.eventdata.commandLine = (?i)use\s anchor level 3 this rule
    field win.eventdata.commandLine="(?i)use\s"

Refined by

1 rule chains off this one, narrowing it further.

Rule dependencies

Depends on

Raw source A net.exe connection to a remote resource was started by · win.eventdata.commandLine = (?i)use\s · Wazuh XML
Esc
Published by Wazuh Core Ruleset ↗, licensed under GPLv2 ↗. Reproduced here unmodified. 
<rule id="92037" level="3">
    <if_sid>92031, 92033</if_sid>
    <field name="win.eventdata.commandLine" type="pcre2">(?i)use\s</field>
    <options>no_full_log</options>
    <description>A net.exe connection to a remote resource was started by $(win.eventdata.parentImage)</description>
    <mitre>
      <id>T1567</id>
    </mitre>
  </rule>

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.