The Gentlemen RaaS - netsh Packet Capture for Network Discovery

Ibrahim Saud@tektrix

•updated Jun 30, 2026•1•0•2

Detects the use of 'netsh trace' to capture network traffic with specific suspicious flags, such as circular file mode, reporting disabled, or interaction with administrative shares. This behavior is often associated with network reconnaissance or the collection of sensitive data by adversaries.