Windows: Netsh helper DLL registration via suspicious registry paths

Flags Netsh helper DLL registration when the DLL path is found in suspicious user/temp-like registry details on Windows.

FreeUnreviewedSigmahighv1

windows-netsh-helper-dll-registration-via-suspicious-registry-paths-e7b18879

title: "Windows: Netsh helper DLL registration via suspicious registry paths"
id: 777552e9-d281-48db-b005-523d5517b596
related:
  - id: 56321594-9087-49d9-bf10-524fe8479452
    type: similar
  - id: c90362e0-2df3-4e61-94fe-b37615814cb1
    type: similar
  - id: e7b18879-676e-4a0e-ae18-27039185a8e7
    type: derived
status: test
description: This rule identifies registry writes under the NetSh key where a new DLL value is pointed to a location commonly abused for persistence. Attackers may register a Netsh helper DLL stored in user-writable or temporary directories to ensure it is loaded by a trusted Windows component. The detection relies on registry set telemetry capturing the target key path and the DLL location string present in the event details.
references:
  - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
  - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-11-28
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.007
logsource:
  category: registry_set
  product: windows
detection:
  selection_target:
    TargetObject|contains: \SOFTWARE\Microsoft\NetSh
  selection_folders_1:
    Details|contains:
      - :\Perflogs\
      - :\Users\Public\
      - :\Windows\Temp\
      - \AppData\Local\Temp\
      - \Temporary Internet
  selection_folders_2:
    - Details|contains|all:
        - :\Users\
        - \Favorites\
    - Details|contains|all:
        - :\Users\
        - \Favourites\
    - Details|contains|all:
        - :\Users\
        - \Contacts\
    - Details|contains|all:
        - :\Users\
        - \Pictures\
  condition: selection_target and 1 of selection_folders_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

What it detects

This rule identifies registry writes under the NetSh key where a new DLL value is pointed to a location commonly abused for persistence. Attackers may register a Netsh helper DLL stored in user-writable or temporary directories to ensure it is loaded by a trusted Windows component. The detection relies on registry set telemetry capturing the target key path and the DLL location string present in the event details.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.