New Netsh Helper DLL Registered From A Suspicious Location

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•0•0•0

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper