T1546.007 Netsh Helper DLL — Detection Rules

Source-backed rule directory

• Potential Persistence Via Netsh Helper DLL · test · medium · {"category":"process_creation","product":"windows"}
• Potential Suspicious Activity Using SeCEdit · test · medium · {"category":"process_creation","product":"windows"}
• New Netsh Helper DLL Registered From A Suspicious Location · test · high · {"category":"registry_set","product":"windows"}
• Potential Persistence Via Netsh Helper DLL - Registry · test · medium · {"category":"registry_set","product":"windows"}

Atlas deterministic concepts

No exact concept selected.

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0575 Detection Strategy for Netsh Helper DLL Persistence via Registry and Child Process Monitoring (Windows)

AN1588 Analytic 1588

Detection focuses on monitoring registry modifications under HKLM\SOFTWARE\Microsoft\Netsh that indicate the addition of helper DLLs, followed by anomalous child process activity or module load behavior initiated by netsh.exe. These behaviors are rarely legitimate and may represent an adversary establishing persistence.