Cross-source coverage

T1546.007 / ATT&CK

Event Triggered Execution: Netsh Helper DLL

5 rules across 2 sources.

From MITRE ATT&CK 19.2

Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at HKLM\SOFTWARE\Microsoft\Netsh.

Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.

Platforms
Windows
Telemetry
WinEventLog:SecurityWinEventLog:Sysmon

How MITRE says to detect it DET0575

Detection Strategy for Netsh Helper DLL Persistence via Registry and Child Process Monitoring (Windows)

Windows Analytic 1588

Detection focuses on monitoring registry modifications under HKLM\SOFTWARE\Microsoft\Netsh that indicate the addition of helper DLLs, followed by anomalous child process activity or module load behavior initiated by netsh.exe. These behaviors are rarely legitimate and may represent an adversary establishing persistence.

  • WinEventLog:Security EventCode=4657
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=7

SigmaHQ/sigma

4 rules
Detection Severity Format
New Netsh Helper DLL Registered From A Suspicious Location High Sigma
Potential Persistence Via Netsh Helper DLL Medium Sigma
Potential Persistence Via Netsh Helper DLL - Registry Medium Sigma
Potential Suspicious Activity Using SeCEdit Medium Sigma

elastic/detection-rules

1 rule
Detection Severity Format
Netsh Helper DLL Low Elastic TOML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.