Gentlemen RaaS Netsh Network Capture for Internal Reconnaissance

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•3

Detects the use of 'netsh trace' to capture network traffic, often associated with reconnaissance activity by threat actors like The Gentlemen RaaS. The rule monitors for command patterns involving trace start/stop, interface show, and specific configuration flags like 'capture=yes', 'report=no', 'filemode=circular', or output to 'ADMIN$' shares.