1200KM / tool
netsh — Attack Tool
netsh is a scripting utility used to interact with networking components on local or remote systems.
Tool identity and evidence
Included because the active pinned ATT&CK object has type tool. This is an upstream classification, not an assurance of benignness or a recommendation to run it.
Aliases: netsh, netsh.exe
Existing author guides
No reviewed association in this snapshot.
Primary documentation
No reviewed association in this snapshot.
Connected ecosystem references
Linked tags
Documented actor use
Explicit actor-to-software uses relationships in the pinned ATT&CK source. These links are historical behavior context, not attribution of current events.
- Carbanak · G0008 · Pinned relationship source (relationship--e2e2d332-f27b-46fb-b48f-4ee1872b321f)
- Naikon · G0019 · Pinned relationship source (relationship--437dd20a-234f-430b-b9ee-4524e1e12aa9)
- Lazarus Group · G0032 · Pinned relationship source (relationship--9f62c4e4-02d4-497b-8039-cc4e816386a5)
- Dragonfly · G0035 · Pinned relationship source (relationship--fc6b1d58-05bf-41a0-a7fd-fcbbae894430)
- APT32 · G0050 · Pinned relationship source (relationship--9c97e0aa-61fd-4f42-881f-763a1b03c16b)
- Magic Hound · G0059 · Pinned relationship source (relationship--9f5f1262-17a7-443e-a531-c9048a91ac8d)
- Volt Typhoon · G1017 · Pinned relationship source (relationship--02e4c994-181d-4aaf-801b-a56ab36a1aaa)
Technique-specific simulations and detections
Detection links describe the associated behavior, not independently verified tool-specific signatures.
Telemetry context
Derived from the explicitly linked TTPs; not proof of sensor coverage for this tool.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.