Gold Open Source
ExplorePackagesVulnerabilitiesMCP Servers
Login
Gold Open Source

The authoritative source for production-ready open-source components. Every package, container image, AI model, and MCP server undergoes rigorous verification for security, malware, and license compliance.

Explore Gold

  • Explore Everything
  • Packages
  • Gold Packages
  • Container Images
  • AI Models
  • MCP Servers
  • Agent Skills
  • Chip Manufacturers

Security Data & Tools

  • Scan Your Dependencies
  • Trending Threats
  • Threat RSS Feeds
  • CVE Database
  • Actively Exploited (KEV)
  • SGZ Zero-Days
  • CWE Index
  • MITRE ATT&CK
  • Malicious Packages
  • Security Glossary
  • Supply-Chain Report
  • Developers (API & Badge)
  • Chrome Extension
  • Credits & Data Sources

Products

  • The Platform
  • ESSCM
  • Portal
  • TPRM
  • OSM
  • Cowork
  • Code / Runner
  • Guard

Use Cases

  • Know Your Software
  • Auto-Fix Vulnerabilities
  • Asset Discovery
  • AI Governance
  • MCP Server Security
  • Supply Chain Compliance
  • Zero-Day Discovery
  • All Use Cases

Company

  • About
  • Pricing
  • Blog
  • Documentation
  • Safeguard Academy
  • Contact
  • Privacy Policy
  • Terms of Service

© 2026 Gold Open Source. All rights reserved.

Built with care bySafeguard
Home/ATT&CK/Software/S0039
MITRE ATT&CK Tool

Net (S0039)

net.exe
ShareXLinkedInRedditHN

The [Net](https://attack.mitre.org/software/S0039) utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. (Citation: Microsoft Net Utility) [Net](https://attack.mitre.org/software/S0039) has a great deal of functionality, (Citation: Savill 1999) much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through [SMB/Windows Admin Shares](https://attack.mitre.org/techniques/T1021/002) using <code>net use</code> commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as <code>net1 user</code>.

Platforms: Windows

▪Techniques implemented (16)

T1201Password Policy DiscoveryT1069.002Domain GroupsT1124System Time Discovery

▪Used by groups (33)

G1054MirrorFaceG0019NaikonG0059Magic Hound
S0039 on MITRE ATT&CK →
T1087.002Domain Account
T1087.001Local Account
T1007System Service Discovery
T1018Remote System Discovery
T1135Network Share Discovery
T1049System Network Connections Discovery
T1070.005Network Share Connection Removal
T1569.002Service Execution
T1136.001Local Account
T1098.007Additional Local or Domain Groups
T1069.001Local Groups
T1021.002SMB/Windows Admin Shares
T1136.002Domain Account
G0082APT38
G0035Dragonfly
G0009Deep Panda
G0027Threat Group-3390
G0049OilRig
G0028Threat Group-1314
G0007APT28
G0096APT41
G0045menuPass
G0004Ke3chang
G0065Leviathan
G1023APT5
G0071Orangeworm
G0093GALLIUM
G0018admin@338
G1032INC Ransom
G0114Chimera
G0006APT1
G0061FIN8
G0092TA505
G1022ToddyCat
G0010Turla
G0064APT33
G0102Wizard Spider
G0034Sandworm Team
G0016APT29
G0050APT32
G1017Volt Typhoon
G1053Storm-0501
G0060BRONZE BUTLER

MITRE ATT&CK® is a registered trademark of The MITRE Corporation. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation.