Hacktoberfest 2026: le issue che i maintainer hanno segnato per ottobre, aperte e adatte ai principianti. Sfoglia le issue Hacktoberfest

[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell Process

Aperta Adatta ai principianti
  • Qualcosa non va?
#4,334 1 commento 1 reazione 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

@mvanhorn ci sta già lavorando.

Dal 12/10/2026.

  • #4336 di @mvanhorn — aperta

Valutazione

Difficoltà
2/5
Tempo stimato
1-3 ore
Idoneità per principianti
62/100
Tipo di issue
Bug
Chiarezza
Specificata chiaramente
Stato di attività
Attiva
Stack tecnologico
python
Ambito
security

Direzione di ricerca

Trova l’analitica chiamata «Windows Cmdline Tool Execution From Non-Shell Process» ed esamina le relative clausole di ricerca per Processes.process_name e Processes.parent_process_name. Aggiungi net.exe a entrambi gli elenchi come descritto, poi verifica la validazione o i test pertinenti dell’analitica. Il lavoro è completato quando le tre catene di processi indicate nell’issue producono il comportamento di rilevamento descritto.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

bug

Hi,

I would like to suggest a small improvement to the detection logic of Windows Cmdline Tool Execution From Non-Shell Process to improve its coverage of suspicious process execution while reducing false positives associated with the legitimate execution of net1.exe.

There are two related issues worth considering:

1. net.exe is missing from the process targets

The current search includes net1.exe in Processes.process_name, but does not include net.exe.

According to MITRE ATT&CK's documentation for [Net (S0039)](https://attack.mitre.org/software/S0039/), net1.exe is used by certain net.exe functions. However, this does not mean that every execution of net.exe necessarily results in a net1.exe child process.

Consider the following process tree:

malicious.exe → net.exe → net1.exe

With the current search, the execution of net.exe by malicious.exe is not detected by this analytic because net.exe is not included in the process targets. Although the subsequent execution of net1.exe may be detected, its direct parent is net.exe, which is not currently an excluded parent process. Consequently, the detection may generate an additional finding for the child process rather than identifying the suspicious execution of net.exe itself.

Including net.exe in Processes.process_name would allow the analytic to identify its execution by a non-shell parent at the first relevant stage of the process chain, including cases where the expected net1.exe child process is not created.

2. Legitimate net.exe → net1.exe execution may generate false positives

The current search includes net1.exe as a target but does not exclude net.exe from Processes.parent_process_name.

As a result, the legitimate execution chain cmd.exe → net.exe → net1.exe may generate a finding for net1.exe, even though the command originated from an explicitly allowed shell process. This can unnecessarily increase the associated entity's risk score.

Adding net.exe to the parent-process exclusion list would prevent this expected parent-child relationship from generating a separate finding, without excluding net.exe itself from the detection targets.

I suggest making the following two changes:

  1. Add net.exe to Processes.process_name so that its execution by a non-excluded parent process can be detected directly.
  2. Add net.exe to the Processes.parent_process_name exclusion list so that the expected net.exe → net1.exe relationship does not independently trigger this analytic.

With these changes, the relevant portion of the search would become:

where Processes.process_name IN (
    "ipconfig.exe",
    "systeminfo.exe",
    "net.exe",
    "net1.exe",
    "arp.exe",
    "nslookup.exe",
    "route.exe",
    "netstat.exe",
    "hostname.exe",
    "whoami.exe"
)
AND NOT Processes.parent_process_name IN (
    "cmd.exe",
    "powershell.exe",
    "powershell_ise.exe",
    "pwsh.exe",
    "explorer.exe",
    "net.exe",
    "-",
    "unknown"
)

The expected behavior for the relevant process chains would be:

  • malicious.exe → net.exe → net1.exe: The execution of net.exe by malicious.exe is detected, while the subsequent net1.exe execution is excluded because its parent is net.exe.
  • malicious.exe → net1.exe: The direct execution of net1.exe by a non-excluded parent remains detectable, preserving the existing detection coverage for this scenario.
  • cmd.exe → net.exe → net1.exe: Neither net.exe nor its net1.exe child generates a finding from this analytic, avoiding the false positive associated with the legitimate shell-originated execution chain.

I am aware that a similar detection, Cmdline Tool Not Executed In CMD Shell, previously existed and was removed in ESCU release 5.2.0. That detection included net.exe in its process targets, which makes its previous implementation relevant to this suggestion.

I understand that the removal may have been intentional and that the current detection may have different design goals. Nevertheless, I believe including net.exe as a process target while also excluding it as a parent process would better align the detection logic with the intended behavior.

Thank you for maintaining Splunk Security Content. I appreciate the work that goes into this project and hope this suggestion can contribute to improving its detection coverage and reducing unnecessary risk findings.

Thank you for your time and consideration.

Best regards

App Version:
ESCU: [6.8.0]

Lingua principale
Python
Stelle
1.7k
Fork
501
Merge medio
2g 5h
PR unite (30g)
41

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di splunk/security_content

Tutte le issue di splunk/security_content

Issue simili

Altre issue su Python

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.