Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
20
10
3
1
1
Contributors
8
7
5
4
3
Categories
18
12
8
2
2
Platforms
34
2
Products / Services
9
9
5
3
2
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Detects execution of netsh.exe when launched from unexpected parent processes (tapctl.exe or openvpnserv.exe) from locations other than the standard System32 or SysWOW64 directories. This pattern is indicative of potential malicious activity or persistence via Netsh helper DLLs masquerading or executing via non-standard paths.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Hunting rule for T1546.007 "Netsh Helper DLL Registration". No public in-the-wild intel reference available; correlate before alerting.
Detects registration of malicious DLL as Netsh helper for persistence
This rule detects attempts to register a Netsh helper DLL for persistence. Netsh (Network Shell) is a command-line scripting utility that allows you to display or modify the network configuration of a locally running computer. Attackers can abuse the 'add helper' command to register a malicious DLL, which will then be loaded by Netsh whenever it runs, providing a persistence mechanism. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings "netsh" and "add helper" in a case-insensitive manner, indicating an attempt to use this technique.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects changes to the Netsh registry key to add a new DLL value that is located in a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper.
This analytic identifies processes launching netsh.exe, a command-line utility used to modify network configurations. It detects this activity by analyzing data from Endpoint Detection and Response (EDR) agents, focusing on process GUIDs, names, parent processes, and command-line executions. This behavior is significant because netsh.exe can be exploited to execute malicious helper DLLs, serving as a persistence mechanism. If confirmed malicious, an attacker could gain persistent access, modify network settings, and potentially escalate privileges, posing a severe threat to the network's integrity and security.
The following analytic identifies modifications to registry keys commonly used for persistence mechanisms. It leverages data from endpoint detection sources like Sysmon or Carbon Black, focusing on specific registry paths known to initiate applications or services during system startup. This activity is significant as unauthorized changes to these keys can indicate attempts to maintain persistence or execute malicious actions upon system boot. If confirmed malicious, this could allow attackers to achieve persistent access, execute arbitrary code, or maintain control over compromised systems, posing a severe threat to system integrity and security.
Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Page 1 of 2