<<< Hide Navigation Hide TOC >>>
Potential Persistence Via Netsh Helper DLL (56321594-9087-49d9-bf10-524fe8479452)
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Cluster A![]() |
Galaxy A![]() |
Cluster B![]() |
Galaxy B![]() |
Level![]() |
---|---|---|---|---|
Netsh Helper DLL - T1546.007 (f63fe421-b1d1-45c0-b8a7-02cd16ff2bed) | Attack Pattern | Potential Persistence Via Netsh Helper DLL (56321594-9087-49d9-bf10-524fe8479452) | Sigma-Rules | 1 |
Netsh Helper DLL - T1546.007 (f63fe421-b1d1-45c0-b8a7-02cd16ff2bed) | Attack Pattern | Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) | Attack Pattern | 2 |