Windows Registry: Netsh Helper DLL value added under SOFTWARE\Microsoft\NetSh
Alerts on Windows registry writes under SOFTWARE\Microsoft\NetSh that add .dll helper entries.
- Product
- windows
- Category
- registry_set
- Author
- Anish Bogati (SigmaHQ), DRL 1.1
- Published
- 2023-11-28
- Updated
- 2026-07-30
ATT&CK techniques
Persistence → Priv EscRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry modifications to the Netsh configuration key by looking for a value containing the .dll extension under SOFTWARE\Microsoft\NetSh. Attackers can use Netsh helper DLLs to load code during normal network configuration activity, providing a persistence mechanism. It relies on registry set telemetry that records the TargetObject and the Details field of the change.
Reporting behind it
- ired.teamhttps://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
- pentestlab.bloghttps://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Netsh Helper DLL value added under SOFTWARE\\Microsoft\\NetSh"
id: 1b4caae0-e354-407f-9c79-b082dbf90006
related:
- id: 56321594-9087-49d9-bf10-524fe8479452
type: similar
- id: e7b18879-676e-4a0e-ae18-27039185a8e7
type: similar
- id: c90362e0-2df3-4e61-94fe-b37615814cb1
type: derived
status: test
description: This rule flags registry modifications to the Netsh configuration key by looking for a value containing the .dll extension under SOFTWARE\Microsoft\NetSh. Attackers can use Netsh helper DLLs to load code during normal network configuration activity, providing a persistence mechanism. It relies on registry set telemetry that records the TargetObject and the Details field of the change.
references:
- https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
- https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml
author: Anish Bogati, Huntrule Team
date: 2023-11-28
modified: 2025-10-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.007
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\NetSh
Details|contains: .dll
filter_main_poqexec:
Image: C:\Windows\System32\poqexec.exe
Details:
- ipmontr.dll
- iasmontr.dll
- ippromon.dll
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate helper added by different programs and the OS
level: medium
license: DRL-1.1