Skip to content

Hide Navigation Hide TOC

Potential Persistence Via Netsh Helper DLL - Registry (c90362e0-2df3-4e61-94fe-b37615814cb1)

Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

Cluster A Galaxy A Cluster B Galaxy B Level
Potential Persistence Via Netsh Helper DLL - Registry (c90362e0-2df3-4e61-94fe-b37615814cb1) Sigma-Rules Netsh Helper DLL - T1546.007 (f63fe421-b1d1-45c0-b8a7-02cd16ff2bed) Attack Pattern 1
Netsh Helper DLL - T1546.007 (f63fe421-b1d1-45c0-b8a7-02cd16ff2bed) Attack Pattern Event Triggered Execution - T1546 (b6301b64-ef57-4cce-bb0b-77026f14a8db) Attack Pattern 2