LOLBAS. GitHub
LIVING OFF THE LAND / OS BINARIES

Netsh.exe

View source

Netsh is a Windows tool used to manipulate network interface settings.

Execute
01COMMAND EXAMPLES
01ATT&CK TECHNIQUES
03DETECTION RESOURCES
01CAPABILITIES
01 / TRADECRAFT

Command reference

1 examples

Execute1

EXAMPLE 01T1546.007

Use Netsh in order to execute a .dll file and also gain persistence, every time the netsh command is called

COMMAND
netsh.exe add helper {PATH_ABSOLUTE:.dll}
USE CASE
Proxy execution of .dll
PRIVILEGES
Admin
OPERATING SYSTEM
Windows Vista, Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11
Execute · DLL
02 / ON DISK

Known paths

C:\WINDOWS\System32\Netsh.exe
C:\WINDOWS\SysWOW64\Netsh.exe
03 / DEFENSIVE INTELLIGENCE

Detection & indicators

3 resources

Indicators & detection notes

  • IOC

    Netsh initiating a network connection

FURTHER READING

Research & resources

COMMUNITY RESEARCH

Acknowledgements

Freddie Barr-Smith
Riccardo Spolaor
Mariano Graziano
Xabier Ugarte-Pedrero