net.exe/net1.exe Local Admin, Domain User, and Group Enumeration

Ankit Mehta@Secvyn

•updated Jun 29, 2026•0•0•3

Detects the use of net.exe or net1.exe to perform enumeration of local administrators or domain-level users and groups. This behavior is commonly associated with attackers attempting to map out the environment for privilege escalation or lateral movement.