On Detection, Information Security, Research, Detection Engineering.
for a long time and is often referred to by later implementations. Like net.exe, I threw NetSess.exe into a disassembler to peek under the hood. I eventually found a call to NetSessionEnum, which is the basis of the tool’s functionality. The difference is that NetSess.exe calls the netapi32 version