windows enabled community high v1.0.0

netsh

Netsh is a Windows tool used to manipulate network interface settings. Located at: C:\WINDOWS\System32\Netsh.exe; C:\WINDOWS\SysWOW64\Netsh.exe.

📋 Live Preview 
netsh
netsh

Sandbox: execFile · Timeout: 30s

Capabilities

security.execution.command

Contract

Outputs

process.output

Command execution output

Side effects: process_spawn

Workflow Edges

Produces

process.output

Resource Profile

ResourceValue
CPUlow
Memory16 MB
Networklow
Disk I/Olow

Examples

Use Netsh in order to execute a .dll file and also gain persistence, every time the netsh command is called (Proxy execution of .dll)

netsh.exe add helper {PATH_ABSOLUTE:.dll}

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml
splunk https://github.com/splunk/security_content/blob/2b87b26bdc2a84b65b1355ffbd5174bdbdb1879c/detections/endpoint/processes_launching_netsh.yml
splunk https://github.com/splunk/security_content/blob/08ed88bd88259c03c771c30170d2934ed0a8f878/detections/deprecated/processes_created_by_netsh.yml
ioc Netsh initiating a network connection

Documentation

netsh

netsh is a Windows LOLBin. Netsh is a Windows tool used to manipulate network interface settings. Located at: C:\WINDOWS\System32\Netsh.exe; C:\WINDOWS\SysWOW64\Netsh.exe.

References