The Gentlemen RaaS - netsh Network Capture via cmd.exe for Credential Harvesting

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the use of the 'netsh trace' command to initiate network packet capture, executed via cmd.exe or powershell.exe. This activity is a known technique used by The Gentlemen RaaS group to perform credential harvesting from unencrypted internal network traffic by saving packet capture files to administrative shares.