Windows Registry: Netsh Helper DLL value added under SOFTWARE\Microsoft\NetSh

Alerts on Windows registry writes under SOFTWARE\Microsoft\NetSh that add .dll helper entries.

FreeUnreviewedSigmamediumv1

windows-registry-netsh-helper-dll-value-added-under-software-microsoft-netsh-c90362e0

title: "Windows Registry: Netsh Helper DLL value added under SOFTWARE\\Microsoft\\NetSh"
id: 1b4caae0-e354-407f-9c79-b082dbf90006
related:
  - id: 56321594-9087-49d9-bf10-524fe8479452
    type: similar
  - id: e7b18879-676e-4a0e-ae18-27039185a8e7
    type: similar
  - id: c90362e0-2df3-4e61-94fe-b37615814cb1
    type: derived
status: test
description: This rule flags registry modifications to the Netsh configuration key by looking for a value containing the .dll extension under SOFTWARE\Microsoft\NetSh. Attackers can use Netsh helper DLLs to load code during normal network configuration activity, providing a persistence mechanism. It relies on registry set telemetry that records the TargetObject and the Details field of the change.
references:
  - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
  - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml
author: Anish Bogati, Huntrule Team
date: 2023-11-28
modified: 2025-10-08
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1546.007
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\NetSh
    Details|contains: .dll
  filter_main_poqexec:
    Image: C:\Windows\System32\poqexec.exe
    Details:
      - ipmontr.dll
      - iasmontr.dll
      - ippromon.dll
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Legitimate helper added by different programs and the OS
level: medium
license: DRL-1.1

What it detects

This rule flags registry modifications to the Netsh configuration key by looking for a value containing the .dll extension under SOFTWARE\Microsoft\NetSh. Attackers can use Netsh helper DLLs to load code during normal network configuration activity, providing a persistence mechanism. It relies on registry set telemetry that records the TargetObject and the Details field of the change.

Known false positives

Legitimate helper added by different programs and the OS

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.