Hacktoberfest 2026：メンテナが10月に向けて印を付けた、オープンで初心者向けの issue。 Hacktoberfest の issue を見る

[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell Process

オープン 初心者向け
  • 何か問題がありますか？
#4,334 コメント 1 件 リアクション 1 件 担当者 0 名 GitHub で見る

メンテナーはふだん 1 日以内に返信

@mvanhorn がすでに取り組んでいます。

2026年10月12日 から。

  • #4336 @mvanhorn による — オープン

評価

難易度
2/5
見積もり時間
1〜3時間
初心者へのやさしさ
62/100
issue の種類
バグ
明瞭さ
明確に書かれている
活発さ
活発
技術スタック
python
領域
security

調査の方向性

「Windows Cmdline Tool Execution From Non-Shell Process」という分析を見つけ、Processes.process_name と Processes.parent_process_name に関する検索句を調べてください。説明に従って両方のリストに net.exe を追加し、関連する分析の検証またはテストを確認してください。Issue に記載された3つのプロセスチェーンで、指定された検知動作が得られれば完了です。

索引モデルが issue の本文から書いたものです。

説明

bug

Hi,

I would like to suggest a small improvement to the detection logic of Windows Cmdline Tool Execution From Non-Shell Process to improve its coverage of suspicious process execution while reducing false positives associated with the legitimate execution of net1.exe.

There are two related issues worth considering:

1. net.exe is missing from the process targets

The current search includes net1.exe in Processes.process_name, but does not include net.exe.

According to MITRE ATT&CK's documentation for [Net (S0039)](https://attack.mitre.org/software/S0039/), net1.exe is used by certain net.exe functions. However, this does not mean that every execution of net.exe necessarily results in a net1.exe child process.

Consider the following process tree:

malicious.exe → net.exe → net1.exe

With the current search, the execution of net.exe by malicious.exe is not detected by this analytic because net.exe is not included in the process targets. Although the subsequent execution of net1.exe may be detected, its direct parent is net.exe, which is not currently an excluded parent process. Consequently, the detection may generate an additional finding for the child process rather than identifying the suspicious execution of net.exe itself.

Including net.exe in Processes.process_name would allow the analytic to identify its execution by a non-shell parent at the first relevant stage of the process chain, including cases where the expected net1.exe child process is not created.

2. Legitimate net.exe → net1.exe execution may generate false positives

The current search includes net1.exe as a target but does not exclude net.exe from Processes.parent_process_name.

As a result, the legitimate execution chain cmd.exe → net.exe → net1.exe may generate a finding for net1.exe, even though the command originated from an explicitly allowed shell process. This can unnecessarily increase the associated entity's risk score.

Adding net.exe to the parent-process exclusion list would prevent this expected parent-child relationship from generating a separate finding, without excluding net.exe itself from the detection targets.

I suggest making the following two changes:

  1. Add net.exe to Processes.process_name so that its execution by a non-excluded parent process can be detected directly.
  2. Add net.exe to the Processes.parent_process_name exclusion list so that the expected net.exe → net1.exe relationship does not independently trigger this analytic.

With these changes, the relevant portion of the search would become:

where Processes.process_name IN (
    "ipconfig.exe",
    "systeminfo.exe",
    "net.exe",
    "net1.exe",
    "arp.exe",
    "nslookup.exe",
    "route.exe",
    "netstat.exe",
    "hostname.exe",
    "whoami.exe"
)
AND NOT Processes.parent_process_name IN (
    "cmd.exe",
    "powershell.exe",
    "powershell_ise.exe",
    "pwsh.exe",
    "explorer.exe",
    "net.exe",
    "-",
    "unknown"
)

The expected behavior for the relevant process chains would be:

  • malicious.exe → net.exe → net1.exe: The execution of net.exe by malicious.exe is detected, while the subsequent net1.exe execution is excluded because its parent is net.exe.
  • malicious.exe → net1.exe: The direct execution of net1.exe by a non-excluded parent remains detectable, preserving the existing detection coverage for this scenario.
  • cmd.exe → net.exe → net1.exe: Neither net.exe nor its net1.exe child generates a finding from this analytic, avoiding the false positive associated with the legitimate shell-originated execution chain.

I am aware that a similar detection, Cmdline Tool Not Executed In CMD Shell, previously existed and was removed in ESCU release 5.2.0. That detection included net.exe in its process targets, which makes its previous implementation relevant to this suggestion.

I understand that the removal may have been intentional and that the current detection may have different design goals. Nevertheless, I believe including net.exe as a process target while also excluding it as a parent process would better align the detection logic with the intended behavior.

Thank you for maintaining Splunk Security Content. I appreciate the work that goes into this project and hope this suggestion can contribute to improving its detection coverage and reducing unnecessary risk findings.

Thank you for your time and consideration.

Best regards

App Version:
ESCU: [6.8.0]

主要言語
Python
スター
1.7k
フォーク
502
平均マージ
3日 16時間
マージ済み PR（30日）
55

環境構築

はじめの一歩

  1. issue を最後まで読み、次にプロジェクトのコントリビューションガイドを読みます。
  2. 着手することを issue にコメントします — 二人が同じ作業をするのを防げます。
  3. リポジトリをフォークし、ブランチを切って変更します。
  4. issue 番号を参照したプルリクエストを送ります。

splunk/security_content のほかの issue

splunk/security_content の issue をすべて見る

似ている issue

Python の issue をもっと見る

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。