T1546.007 — Netsh Helper DLL

Tactics: Privilege Escalation, Persistence · Platforms: Windows

Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending…

Sub-technique of Event Triggered Execution (T1546).

Sigma detection rules (1)

T1546.007 Event Triggered Execution: Netsh Helper DLL

title: "T1546.007 Event Triggered Execution: Netsh Helper DLL"
id: faa9019c-7886-46e9-bd6d-7afccb424180
description: 'Detection Strategy for Netsh Helper DLL Persistence via Registry and Child Process Monitoring. (Data Component: Windows Registry Key Modification / Process Creation; baseline tier: windows-eventid.) Tune using: TimeWindow, NetshChildProcessWhitelist, DLLLoadPath.'
references:
  - https://attack.mitre.org/techniques/T1546/007
author: Shahrukh Khan
date: 2026-04-15
license: MIT
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.007

logsource:
  product: windows
  service: sysmon

detection:
  selection_registry:
    EventID: 13
    TargetObject|contains: '\Software\Microsoft\Netsh'
  selection_command:
    EventID: 1
    Image|endswith: '\netsh.exe'
    CommandLine|contains: 'add helper'
  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'
  condition: 1 of selection_* and not filter_system_account

falsepositives:
  - Legitimate network diagnostic/configuration tooling registering netsh helper DLLs.

level: medium

Related sub-techniques

Explore