Windows netsh.exe "add helper" execution for custom helper DLL loading

title: Windows netsh.exe "add helper" execution for custom helper DLL loading
id: e1905502-01de-4051-ab7d-02cb1cebbffb
related:
  - id: c90362e0-2df3-4e61-94fe-b37615814cb1
    type: similar
  - id: e7b18879-676e-4a0e-ae18-27039185a8e7
    type: similar
  - id: 56321594-9087-49d9-bf10-524fe8479452
    type: derived
status: test
description: This rule identifies process creation events where netsh.exe is executed with command-line arguments containing both "add" and "helper", matching netsh helper registration behavior. Attackers can abuse this to add a custom helper DLL so it is invoked when netsh.exe runs, enabling a persistence-like execution path. The detection relies on Windows process creation telemetry, including the process image path and full command line content.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md
  - https://github.com/outflanknl/NetshHelperBeacon
  - https://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2023-11-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.007
  - attack.s0108
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - OriginalFileName: netsh.exe
    - Image|endswith: \netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - add
      - helper
  condition: all of selection_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1