Software: netsh, netsh.exe

netsh, netsh.exe
Software
ID	S0108
Aliases	netsh, netsh.exe
Type	Utility

netsh is a scripting utility used to interact with networking components on local or remote systems.1

Techniques Used

• Disabling Security Tools - netsh can be used to disable local firewall settings.2

• Security Software Discovery - netsh can be used to discover system firewall settings.2

• Connection Proxy - netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.3

• Netsh Helper DLL - netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.4

Groups

The following groups use this software:

• Carbanak
• Lazarus Group
• Naikon

References

1. ^ ↑ Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.
2. a b ↑ Microsoft. (2009, June 3). Netsh Commands for Windows Firewall. Retrieved April 20, 2016.

3. ^ ↑ Kaspersky Lab's Global Research and Analysis Team. (2017, February 8). Fileless attacks against enterprise networks. Retrieved February 8, 2017.
4. ^ ↑ Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017.