|T1546.001||Change Default File Association|
|T1546.003||Windows Management Instrumentation Event Subscription|
|T1546.004||Unix Shell Configuration Modification|
|T1546.007||Netsh Helper DLL|
|T1546.012||Image File Execution Options Injection|
|T1546.015||Component Object Model Hijacking|
Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at
Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.
netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
|ID||Data Source||Data Component||Detects|
Monitor executed commands and arguments that may establish persistence by executing malicious content triggered by Netsh Helper DLLs.
Monitor DLL/PE file events, specifically creation of these binary files as well as the loading of DLLs into processes. Look for DLLs that are not recognized or not normally loaded into a process.
It is likely unusual for netsh.exe to have any child processes in most environments. Monitor process executions and investigate any child processes spawned by netsh.exe for malicious behavior.
|DS0024||Windows Registry||Windows Registry Key Modification||