Techniques › T1546 › T1546.007
T1546.007 Netsh Helper DLL
privilege escalation · persistence — Windows · attack.mitre.org · JSON
1
MITRE detection strategy
1
analytics
4
Sigma rules tagged attack.t1546.007
0
KEV CVEs mapped here
<p>Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>.</p><p>Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0575 Detection Strategy for Netsh Helper DLL Persistence via Registry and Child Process Monitoring (Windows) v1.0
AN1588 WindowsDetection focuses on monitoring registry modifications under HKLM\SOFTWARE\Microsoft\Netsh that indicate the addition of helper DLLs, followed by anomalous child process activity or module load behavior initiated by netsh.exe. These behaviors are rarely legitimate and may represent an adversary establishing persistence.Tunable:
TimeWindowNetshChildProcessWhitelistDLLLoadPath
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1546.007
Author: Victor Sergeev, oscd.community
· 2019-10-25 (modified 2023-11-28) · logsource: product=windows category=process_creation · 56321594-9087-49d9-bf10-524fe8479452
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
Author: Janantha Marasinghe
· 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Author: Anish Bogati
· 2023-11-28 (modified 2025-10-08) · logsource: product=windows category=registry_set · c90362e0-2df3-4e61-94fe-b37615814cb1
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-11-28 · logsource: product=windows category=registry_set · e7b18879-676e-4a0e-ae18-27039185a8e7
Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Rules tagged at the parent level (attack.t1546) 10
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Omkar Gudhate
· 2020-09-27 (modified 2023-09-28) · logsource: product=windows category=registry_set · 07743f65-7ec9-404a-a519-913db7118a8d
Detects changes to 'HKCU\Software\Classes\Folder\shell\open\command\DelegateExecute'
Author: Kyaw Min Thein, Furkan Caliskan (@caliskanfurkan_)
· 2020-06-22 (modified 2023-10-11) · logsource: product=windows category=process_creation · 0ba863e6-def5-4e50-9cea-4dd8c7dc46a4
Detects the malicious use of a control panel item
Author: frack113
· 2022-04-23 · logsource: product=windows category=file_event · 0c3fac91-5627-46e8-a6a8-a0d7b9b8ae1b
Get-Variable is a valid PowerShell cmdlet
WindowsApps is by default in the path where PowerShell is executed.
So when the Get-Variable command is issued on PowerShell execution, the system first looks for the Get-Variable executable in the path and executes the malicious binary instead of looking for the PowerShell cmdlet.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-02-08 · logsource: product=windows category=file_event · 117d3d3a-755c-4a61-b23e-9171146d094c
Detects the creation of a macro file for Outlook.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · 396ae3eb-4174-4b9b-880e-dc0364d78a19
Detects the modification of Outlook setting "LoadMacroProviderOnBoot" which if enabled allows the automatic loading of any configured VBA project/module
Author: Denis Szadkowski, DIRT / DCSO CyTec
· 2022-10-09 · logsource: product=windows service=application · 711ab2fe-c9ba-4746-8840-5228a58c3cb8
This rule detects the execution of the extended storage procedure backdoor named Maggie in the context of Microsoft SQL server
Author: MSTIC, FPT.EagleEye
· 2021-06-15 (modified 2022-10-09) · logsource: product=windows category=process_creation · 7ba08e95-1e0b-40cd-9db5-b980555e42fd
Suspicious behaviours related to an actor tracked by Microsoft as SOURGUM
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-02-08) · logsource: product=windows category=file_event · 8c31f563-f9a7-450c-bfa8-35f8f32f1f61
Detects the creation of a macro file for Outlook.
Author: Florian Roth (Nextron Systems)
· 2021-03-09 (modified 2023-03-09) · logsource: product=windows category=process_creation · bbb2dedd-a0e3-46ab-ba6c-6c82ae7a9aa7
Detects activity observed by different researchers to be HAFNIUM group activity (or related) on Exchange servers
Author: @ScoubiMtl
· 2021-04-05 (modified 2023-08-17) · logsource: product=windows category=registry_set · e3b50fa5-3c3f-444e-937b-0a99d33731cd
Detects the modification of Outlook security setting to allow unprompted execution of macros.