Network Share Enumeration via net.exe or net1.exe

Ankit Mehta@Secvyn

•updated Jun 29, 2026•1•0•1

Detects the use of 'net.exe' or 'net1.exe' with arguments 'view', 'share', or 'use' that appear in rapid succession or are initiated by potentially suspicious parent processes. This behavior is often associated with network enumeration and reconnaissance activities.