Windows netsh.exe "add helper" execution for custom helper DLL loading
Flags netsh.exe being run with "add helper" parameters that can register a custom helper DLL.
- Product
- windows
- Category
- process_creation
- Author
- Victor Sergeev, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-10-25
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process creation events where netsh.exe is executed with command-line arguments containing both "add" and "helper", matching netsh helper registration behavior. Attackers can abuse this to add a custom helper DLL so it is invoked when netsh.exe runs, enabling a persistence-like execution path. The detection relies on Windows process creation telemetry, including the process image path and full command line content.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md
- github.comhttps://github.com/outflanknl/NetshHelperBeacon
- web.archive.orghttps://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows netsh.exe "add helper" execution for custom helper DLL loading
id: e1905502-01de-4051-ab7d-02cb1cebbffb
related:
- id: c90362e0-2df3-4e61-94fe-b37615814cb1
type: similar
- id: e7b18879-676e-4a0e-ae18-27039185a8e7
type: similar
- id: 56321594-9087-49d9-bf10-524fe8479452
type: derived
status: test
description: This rule identifies process creation events where netsh.exe is executed with command-line arguments containing both "add" and "helper", matching netsh helper registration behavior. Attackers can abuse this to add a custom helper DLL so it is invoked when netsh.exe runs, enabling a persistence-like execution path. The detection relies on Windows process creation telemetry, including the process image path and full command line content.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md
- https://github.com/outflanknl/NetshHelperBeacon
- https://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml
author: Victor Sergeev, oscd.community, Huntrule Team
date: 2019-10-25
modified: 2023-11-28
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.007
- attack.s0108
logsource:
category: process_creation
product: windows
detection:
selection_img:
- OriginalFileName: netsh.exe
- Image|endswith: \netsh.exe
selection_cli:
CommandLine|contains|all:
- add
- helper
condition: all of selection_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1