Hacktoberfest 2026: the issues maintainers tagged for October, open and beginner-friendly. Browse Hacktoberfest issues

[BUG] Improve net.exe and net1.exe Detection Logic in Windows Cmdline Tool Execution From Non-Shell Process

Open Beginner friendly
  • Is something wrong?
#4,334 1 comment 0 reactions 0 assignees View on GitHub

Maintainers usually reply within 1 day

@mvanhorn is already working on this.

Since Oct 12, 2026.

  • #4336 by @mvanhorn — open

Assessment

Difficulty
2/5
Estimated time
1-3 hours
Newbie friendliness
62/100
Issue type
Bug
Clarity
Clearly specified
Activity status
Active
Tech stack
python
Domain
security

Research direction

Find the analytic named “Windows Cmdline Tool Execution From Non-Shell Process” and inspect its search clauses for Processes.process_name and Processes.parent_process_name. Add net.exe to both lists as described, then review the relevant analytic validation or tests. Done when the three process chains in the issue produce the stated detection behavior.

Written by the indexing model from the issue text.

Description

bug

Hi,

I would like to suggest a small improvement to the detection logic of Windows Cmdline Tool Execution From Non-Shell Process to improve its coverage of suspicious process execution while reducing false positives associated with the legitimate execution of net1.exe.

There are two related issues worth considering:

1. net.exe is missing from the process targets

The current search includes net1.exe in Processes.process_name, but does not include net.exe.

According to MITRE ATT&CK's documentation for [Net (S0039)](https://attack.mitre.org/software/S0039/), net1.exe is used by certain net.exe functions. However, this does not mean that every execution of net.exe necessarily results in a net1.exe child process.

Consider the following process tree:

malicious.exe → net.exe → net1.exe

With the current search, the execution of net.exe by malicious.exe is not detected by this analytic because net.exe is not included in the process targets. Although the subsequent execution of net1.exe may be detected, its direct parent is net.exe, which is not currently an excluded parent process. Consequently, the detection may generate an additional finding for the child process rather than identifying the suspicious execution of net.exe itself.

Including net.exe in Processes.process_name would allow the analytic to identify its execution by a non-shell parent at the first relevant stage of the process chain, including cases where the expected net1.exe child process is not created.

2. Legitimate net.exe → net1.exe execution may generate false positives

The current search includes net1.exe as a target but does not exclude net.exe from Processes.parent_process_name.

As a result, the legitimate execution chain cmd.exe → net.exe → net1.exe may generate a finding for net1.exe, even though the command originated from an explicitly allowed shell process. This can unnecessarily increase the associated entity's risk score.

Adding net.exe to the parent-process exclusion list would prevent this expected parent-child relationship from generating a separate finding, without excluding net.exe itself from the detection targets.

I suggest making the following two changes:

  1. Add net.exe to Processes.process_name so that its execution by a non-excluded parent process can be detected directly.
  2. Add net.exe to the Processes.parent_process_name exclusion list so that the expected net.exe → net1.exe relationship does not independently trigger this analytic.

With these changes, the relevant portion of the search would become:

where Processes.process_name IN (
    "ipconfig.exe",
    "systeminfo.exe",
    "net.exe",
    "net1.exe",
    "arp.exe",
    "nslookup.exe",
    "route.exe",
    "netstat.exe",
    "hostname.exe",
    "whoami.exe"
)
AND NOT Processes.parent_process_name IN (
    "cmd.exe",
    "powershell.exe",
    "powershell_ise.exe",
    "pwsh.exe",
    "explorer.exe",
    "net.exe",
    "-",
    "unknown"
)

The expected behavior for the relevant process chains would be:

  • malicious.exe → net.exe → net1.exe: The execution of net.exe by malicious.exe is detected, while the subsequent net1.exe execution is excluded because its parent is net.exe.
  • malicious.exe → net1.exe: The direct execution of net1.exe by a non-excluded parent remains detectable, preserving the existing detection coverage for this scenario.
  • cmd.exe → net.exe → net1.exe: Neither net.exe nor its net1.exe child generates a finding from this analytic, avoiding the false positive associated with the legitimate shell-originated execution chain.

I am aware that a similar detection, Cmdline Tool Not Executed In CMD Shell, previously existed and was removed in ESCU release 5.2.0. That detection included net.exe in its process targets, which makes its previous implementation relevant to this suggestion.

I understand that the removal may have been intentional and that the current detection may have different design goals. Nevertheless, I believe including net.exe as a process target while also excluding it as a parent process would better align the detection logic with the intended behavior.

Thank you for maintaining Splunk Security Content. I appreciate the work that goes into this project and hope this suggestion can contribute to improving its detection coverage and reducing unnecessary risk findings.

Thank you for your time and consideration.

Best regards

App Version:
ESCU: [6.8.0]

Dominant language
Python
Stars
1.7k
Forks
498
Avg merge
2d 5h
Merged PRs (30d)
41

Getting set up

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

More from splunk/security_content

All issues in splunk/security_content

Similar issues

More Python issues

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.