Hacktoberfest 2026: los issues que los mantenedores marcaron para octubre, abiertos y aptos para principiantes. Explorar issues de Hacktoberfest

[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell Process

Abierto Apto para principiantes
  • ¿Algo no está bien?
#4,334 1 comentario 1 reacción 0 asignados Ver en GitHub

Los mantenedores suelen responder en 1 día

@mvanhorn ya está trabajando en esto.

Desde el 12/10/2026.

  • #4336 de @mvanhorn — abierto

Evaluación

Dificultad
2/5
Tiempo estimado
1-3 horas
Aptitud para principiantes
62/100
Tipo de issue
Error
Claridad
Bien especificado
Estado de actividad
Activo
Stack tecnológico
python
Área
security

Línea de trabajo

Busca la analítica llamada «Windows Cmdline Tool Execution From Non-Shell Process» e inspecciona sus cláusulas de búsqueda para Processes.process_name y Processes.parent_process_name. Añade net.exe a ambas listas como se describe y después revisa la validación o las pruebas pertinentes de la analítica. La tarea estará completa cuando las tres cadenas de procesos del issue produzcan el comportamiento de detección indicado.

Escrito por el modelo de indexación a partir del texto del issue.

Descripción

bug

Hi,

I would like to suggest a small improvement to the detection logic of Windows Cmdline Tool Execution From Non-Shell Process to improve its coverage of suspicious process execution while reducing false positives associated with the legitimate execution of net1.exe.

There are two related issues worth considering:

1. net.exe is missing from the process targets

The current search includes net1.exe in Processes.process_name, but does not include net.exe.

According to MITRE ATT&CK's documentation for [Net (S0039)](https://attack.mitre.org/software/S0039/), net1.exe is used by certain net.exe functions. However, this does not mean that every execution of net.exe necessarily results in a net1.exe child process.

Consider the following process tree:

malicious.exe → net.exe → net1.exe

With the current search, the execution of net.exe by malicious.exe is not detected by this analytic because net.exe is not included in the process targets. Although the subsequent execution of net1.exe may be detected, its direct parent is net.exe, which is not currently an excluded parent process. Consequently, the detection may generate an additional finding for the child process rather than identifying the suspicious execution of net.exe itself.

Including net.exe in Processes.process_name would allow the analytic to identify its execution by a non-shell parent at the first relevant stage of the process chain, including cases where the expected net1.exe child process is not created.

2. Legitimate net.exe → net1.exe execution may generate false positives

The current search includes net1.exe as a target but does not exclude net.exe from Processes.parent_process_name.

As a result, the legitimate execution chain cmd.exe → net.exe → net1.exe may generate a finding for net1.exe, even though the command originated from an explicitly allowed shell process. This can unnecessarily increase the associated entity's risk score.

Adding net.exe to the parent-process exclusion list would prevent this expected parent-child relationship from generating a separate finding, without excluding net.exe itself from the detection targets.

I suggest making the following two changes:

  1. Add net.exe to Processes.process_name so that its execution by a non-excluded parent process can be detected directly.
  2. Add net.exe to the Processes.parent_process_name exclusion list so that the expected net.exe → net1.exe relationship does not independently trigger this analytic.

With these changes, the relevant portion of the search would become:

where Processes.process_name IN (
    "ipconfig.exe",
    "systeminfo.exe",
    "net.exe",
    "net1.exe",
    "arp.exe",
    "nslookup.exe",
    "route.exe",
    "netstat.exe",
    "hostname.exe",
    "whoami.exe"
)
AND NOT Processes.parent_process_name IN (
    "cmd.exe",
    "powershell.exe",
    "powershell_ise.exe",
    "pwsh.exe",
    "explorer.exe",
    "net.exe",
    "-",
    "unknown"
)

The expected behavior for the relevant process chains would be:

  • malicious.exe → net.exe → net1.exe: The execution of net.exe by malicious.exe is detected, while the subsequent net1.exe execution is excluded because its parent is net.exe.
  • malicious.exe → net1.exe: The direct execution of net1.exe by a non-excluded parent remains detectable, preserving the existing detection coverage for this scenario.
  • cmd.exe → net.exe → net1.exe: Neither net.exe nor its net1.exe child generates a finding from this analytic, avoiding the false positive associated with the legitimate shell-originated execution chain.

I am aware that a similar detection, Cmdline Tool Not Executed In CMD Shell, previously existed and was removed in ESCU release 5.2.0. That detection included net.exe in its process targets, which makes its previous implementation relevant to this suggestion.

I understand that the removal may have been intentional and that the current detection may have different design goals. Nevertheless, I believe including net.exe as a process target while also excluding it as a parent process would better align the detection logic with the intended behavior.

Thank you for maintaining Splunk Security Content. I appreciate the work that goes into this project and hope this suggestion can contribute to improving its detection coverage and reducing unnecessary risk findings.

Thank you for your time and consideration.

Best regards

App Version:
ESCU: [6.8.0]

Lenguaje dominante
Python
Estrellas
1.7k
Forks
502
Merge medio
3 d 16 h
PR fusionados (30 d)
55

Preparar el entorno

Primeros pasos

  1. Lee el issue completo y luego la guía de contribución del proyecto.
  2. Comenta en el issue que vas a ocuparte — evita que dos personas hagan lo mismo.
  3. Haz un fork del repositorio y trabaja en una rama.
  4. Abre un pull request que haga referencia al número del issue.

Más de splunk/security_content

Todos los issues de splunk/security_content

Issues similares

Más issues de Python

Recibe los nuevos issues en tu correo

Un resumen breve de issues de GitHub para principiantes.