Net
Software · ATTACK:enterprise:S0039
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:S0039",
"title": "Net",
"type": "Software",
"source_url": "https://attack.mitre.org/software/S0039",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "tool--03342581-f790-4f03-ba41-e82e67392e23",
"external_id": "S0039",
"domain": "enterprise",
"created": "2017-05-31T21:32:31.601Z",
"modified": "2026-05-12T15:12:00.740Z",
"version": "2.8",
"aliases": [
],
"tactics": [
],
"source_references": [
{
"source_name": "Microsoft Net Utility",
"url": "https://msdn.microsoft.com/en-us/library/aa939914"
},
{
"source_name": "Savill 1999",
"url": "https://web.archive.org/web/20150511162820/http://windowsitpro.com/windows/netexe-reference"
}
]
}Explicit source assertions (50)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1201
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0224ebf5-13ef-4fb0-b9e7-53ea58c15a4d
Savill 1999ATTACK:enterprise:G1054 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--087ce3ec-8c2b-4035-8b47-4ea17eb45746
JPCERT MirrorFace JUL 2024ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1069.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0eb8fe0a-6a6b-4d66-b6ff-e1d7f8f18948
Savill 1999ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0ef9bb79-c221-40a8-94b0-58bfc816565f
Baumgartner Naikon 2015 · Bitdefender Naikon April 2021ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1124
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--12455fe5-42dd-420e-839e-8a96886488f7
TechNet Net TimeATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1087.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--14612b22-b271-4e93-8f66-d86ce8e10c29
Microsoft NetATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1087.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--15f74597-d92d-406f-9941-c0dfef3cb609
Savill 1999ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1b255a88-0189-4afa-a69f-fa99127e693e
DFIR Phosphorus November 2021 · DFIR Report APT35 ProxyShell March 2022ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1d36c3e8-238f-46c6-9b20-9fb4cb5c75ba
Savill 1999ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1f0832ca-30f2-4f5a-8e92-1d15222fc087
FireEye APT38 Oct 2018ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2c9e64fa-52a5-4233-a1b7-333e5d7b9d40
US-CERT TA18-074AATTACK:enterprise:G0009 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2df910df-37cc-4349-96c3-f938fa5a9054
Alperovitch 2014ATTACK:enterprise:G0027 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2e45dc12-f493-42ea-829e-011ba786bef1
SecureWorks BRONZE UNION June 2017ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1018
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--31ec568c-53c7-4dfb-8bfb-bfb7addca7ee
Savill 1999ATTACK:enterprise:C0026 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--35646501-5bff-41bb-a50f-c4f3b1d326f9
Mandiant Suspected Turla Campaign February 2023ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1135
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3b5d1788-c59b-4e84-97b0-b109df608619
Savill 1999ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3fb836b7-41cf-40d1-bd56-14e45e6bbd02
Palo Alto OilRig May 2016 · FireEye APT34 Dec 2017 · Symantec Crambus OCT 2023ATTACK:enterprise:G0028 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--489e5386-b177-455f-a8b3-d3c6e7afb9b1
Dell TG-1314ATTACK:enterprise:G0007 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4a1336e8-9abb-4217-8a90-78ce55325aaa
Cybersecurity Advisory GRU Brute Force Campaign July 2021ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1049
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4c94f67d-6662-44ea-be75-ded8b2dbfa00
Savill 1999ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1070.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4e167937-d152-4c57-a7b7-e3b407470720
Technet Net UseATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1569.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5fc0ca38-bb65-43ab-b8b2-6861442b25a8
Savill 1999ATTACK:enterprise:G0096 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--66d42126-d337-4a00-ae35-d8af7203a6eb
FireEye APT41 Aug 2019ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1136.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7185fe1c-1565-4175-bc7e-539ff704f4cb
Savill 1999ATTACK:enterprise:G0045 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--7193ed4c-7169-46fa-9294-d74d912510d0
PWC Cloud Hopper Technical Annex April 2017ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1098.007
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--751ab02e-aef4-442b-8e3d-aa392c97be7e
Microsoft Net Group · Microsoft Net LocalgroupATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1069.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--75f7d0e0-b1e9-4289-8895-d8a262930523
Savill 1999ATTACK:enterprise:G0004 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--77f9936d-1ba7-42a8-879d-1a6e90156366
Mandiant Operation Ke3chang November 2014 · NCC Group APT15 Alive and StrongATTACK:enterprise:G0065 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--86f6e11c-759b-438d-9f32-004708c68f2c
FireEye APT40 March 2019ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--95416174-bdf3-4ffc-9174-6b89d4b72cd4
Mandiant Pulse Secure Update May 2021ATTACK:enterprise:G0071 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--960d642d-a2f7-4b78-8363-fa94aff7bf86
Symantec Orangeworm April 2018ATTACK:enterprise:G0093 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--96db4cd3-0493-4944-b47c-15b7db6f0010
Cybereason Soft Cell June 2019ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1021.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a2423ac3-94b4-4936-962b-06562115cb70
Savill 1999ATTACK:enterprise:G0018 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a36263d1-d109-4c94-930a-6be1e9615527
FireEye admin@338ATTACK:enterprise:G1032 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--a6bc7e9a-4212-4809-8ae1-814b4ad01657
Huntress INC Ransomware May 2024ATTACK:enterprise:G0114 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b626d35a-2ddd-425a-97bc-84c328b57726
NCC Group Chimera January 2021ATTACK:enterprise:G0006 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b6f70ba6-bff1-4b40-a418-356e7b6efa27
Mandiant APT1ATTACK:enterprise:G0061 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bc1c5d97-5e95-4ba3-bf61-ffe3de56d508
FireEye Know Your Enemy FIN8 Aug 2016ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c5be8127-669e-49b9-b603-581e3498d203
Trend Micro TA505 June 2019ATTACK:enterprise:G1022 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c614775b-cc8d-4e60-8415-68a10fe9579d
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:S0039 → uses → ATTACK:enterprise:T1136.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6e308b7-18ac-43c6-bba7-dea71d8f9d67
Savill 1999ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cd79beea-20ee-4b4f-aad1-5cc34d27398c
Kaspersky TurlaATTACK:enterprise:G0064 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d22af09f-5536-4416-827c-e401cfae3002
Symantec Elfin Mar 2019ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d64f970a-8003-41bf-9769-d849c12340ed
Red Canary Hospital Thwarted Ryuk October 2020 · CrowdStrike Ryuk January 2019 · FireEye KEGTAP SINGLEMALT October 2020 · Sophos New Ryuk Attack October 2020 · Mandiant FIN12 Oct 2021 · DFIR Ryuk 2 Hour Speed Run November 2020 · DFIR Ryuk in 5 Hours October 2020 · DFIR Ryuk's Return October 2020ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d993160c-17cd-4026-996a-f7c9bb5b5fc7
Dragos Crashoverride 2018ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--db80dd29-d335-48b9-853e-5f15e576acb3
CISA SoreFang July 2016ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e725bb68-9fe3-4c43-8ef5-57d57b40b066
Cybereason Cobalt Kitty 2017ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ec0161c2-2e79-4166-b3e5-5a7026366865
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023ATTACK:enterprise:G1053 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--eea7a647-322f-4d4a-a6b4-28b3b8ca8f32
Microsoft Storm-501 Sabbath Ransomware Embargo September 2024 · Microsoft Storm-0501 Embargo Ransomware August 2025ATTACK:enterprise:G0060 → uses → ATTACK:enterprise:S0039
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--f6d23c6b-01c8-4bea-9bc6-2c66fbbbd3ae
Secureworks BRONZE BUTLER Oct 2017