1200KM / sigma-rule
Potential Persistence Via Netsh Helper DLL - Registry — Sigma Rule
Sigma rule c90362e0-2df3-4e61-94fe-b37615814cb1. Potential Persistence Via Netsh Helper DLL - Registry — Sigma Rule. Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
Rule metadata and linked tags
Author: Anish Bogati. Source status: test; severity: medium. Source dates: 2023-11-28 / 2025-10-08.
{
"category": "registry_set",
"product": "windows"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: dd2807303c62897f3ce1b9914bbba7dadedb798682736858daf110acea106a11
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Potential Persistence Via Netsh Helper DLL - Registry
id: c90362e0-2df3-4e61-94fe-b37615814cb1
related:
- id: 56321594-9087-49d9-bf10-524fe8479452
type: similar
- id: e7b18879-676e-4a0e-ae18-27039185a8e7
type: similar
status: test
description: |
Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
references:
- https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
- https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
author: Anish Bogati
date: 2023-11-28
modified: 2025-10-08
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1546.007
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: '\SOFTWARE\Microsoft\NetSh'
Details|contains: '.dll'
filter_main_poqexec:
Image: 'C:\Windows\System32\poqexec.exe'
Details:
- 'ipmontr.dll'
- 'iasmontr.dll'
- 'ippromon.dll'
condition: selection and not 1 of filter_main_*
falsepositives:
- Legitimate helper added by different programs and the OS
level: medium
False positives
- Legitimate helper added by different programs and the OS
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.