The Gentlemen RaaS: netsh Network Capture and Portproxy Reconnaissance

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•6

Detects the use of the Windows 'netsh.exe' utility to perform network port proxying or tracing configurations, initiated by common command-line shells (cmd.exe, powershell.exe). Attackers may use these capabilities for lateral movement, persistence, or to sniff network traffic.