[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell Process #4334

Hi,

I would like to suggest a small improvement to the detection logic of Windows Cmdline Tool Execution From Non-Shell Process to improve its coverage of suspicious process execution while reducing false positives associated with the legitimate execution of net1.exe.

There are two related issues worth considering:

1. net.exe is missing from the process targets

The current search includes net1.exe in Processes.process_name, but does not include net.exe.

According to MITRE ATT&CK's documentation for [Net (S0039)](https://attack.mitre.org/software/S0039/), net1.exe is used by certain net.exe functions. However, this does not mean that every execution of net.exe necessarily results in a net1.exe child process.

Consider the following process tree:

malicious.exe → net.exe → net1.exe

With the current search, the execution of net.exe by malicious.exe is not detected by this analytic because net.exe is not included in the process targets. Although the subsequent execution of net1.exe may be detected, its direct parent is net.exe, which is not currently an excluded parent process. Consequently, the detection may generate an additional finding for the child process rather than identifying the suspicious execution of net.exe itself.

Including net.exe in Processes.process_name would allow the analytic to identify its execution by a non-shell parent at the first relevant stage of the process chain, including cases where the expected net1.exe child process is not created.

2. Legitimate net.exe → net1.exe execution may generate false positives

The current search includes net1.exe as a target but does not exclude net.exe from Processes.parent_process_name.

As a result, the legitimate execution chain cmd.exe → net.exe → net1.exe may generate a finding for net1.exe, even though the command originated from an explicitly allowed shell process. This can unnecessarily increase the associated entity's risk score.

Adding net.exe to the parent-process exclusion list would prevent this expected parent-child relationship from generating a separate finding, without excluding net.exe itself from the detection targets.

I suggest making the following two changes:

1. Add net.exe to Processes.process_name so that its execution by a non-excluded parent process can be detected directly.
2. Add net.exe to the Processes.parent_process_name exclusion list so that the expected net.exe → net1.exe relationship does not independently trigger this analytic.

With these changes, the relevant portion of the search would become:

where Processes.process_name IN (
    "ipconfig.exe",
    "systeminfo.exe",
    "net.exe",
    "net1.exe",
    "arp.exe",
    "nslookup.exe",
    "route.exe",
    "netstat.exe",
    "hostname.exe",
    "whoami.exe"
)
AND NOT Processes.parent_process_name IN (
    "cmd.exe",
    "powershell.exe",
    "powershell_ise.exe",
    "pwsh.exe",
    "explorer.exe",
    "net.exe",
    "-",
    "unknown"
)

The expected behavior for the relevant process chains would be:

• malicious.exe → net.exe → net1.exe: The execution of net.exe by malicious.exe is detected, while the subsequent net1.exe execution is excluded because its parent is net.exe.
• malicious.exe → net1.exe: The direct execution of net1.exe by a non-excluded parent remains detectable, preserving the existing detection coverage for this scenario.
• cmd.exe → net.exe → net1.exe: Neither net.exe nor its net1.exe child generates a finding from this analytic, avoiding the false positive associated with the legitimate shell-originated execution chain.

I am aware that a similar detection, Cmdline Tool Not Executed In CMD Shell, previously existed and was removed in ESCU release 5.2.0. That detection included net.exe in its process targets, which makes its previous implementation relevant to this suggestion.

I understand that the removal may have been intentional and that the current detection may have different design goals. Nevertheless, I believe including net.exe as a process target while also excluding it as a parent process would better align the detection logic with the intended behavior.

Thank you for maintaining Splunk Security Content. I appreciate the work that goes into this project and hope this suggestion can contribute to improving its detection coverage and reducing unnecessary risk findings.

Thank you for your time and consideration.

Best regards

App Version:
ESCU: [6.8.0]