detection.wiki

Detection rules › Sigma

Netsh helper DLL abuse (Reg via Sysmon)

Status
experimental
Severity
high
Log source
product windows, category registry_event
Author
mdecrevoisier
Source
github.com/mdecrevoisier/SIGMA-detection-rules

Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.007 Event Triggered Execution: Netsh Helper DLL

Event coverage

ProviderEventTitle
SysmonEvent ID 12RegistryEvent (Object create and delete)
SysmonEvent ID 13RegistryEvent (Value Set)
SysmonEvent ID 14RegistryEvent (Key and Value Rename)

Rule body yaml

title: Netsh helper DLL abuse (Reg via Sysmon)
description: Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0003-Persistence/T1546-Event%20Triggered%20Execution
- https://www.hackingarticles.in/windows-persistence-using-netsh/
- https://liberty-shell.com/sec/2018/07/28/netshlep/
- https://github.com/outflanknl/NetshHelperBeacon
- https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
- https://lolbas-project.github.io/lolbas/Binaries/Netsh/
- https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
tags:
- attack.persistence
- attack.t1546.007
author: mdecrevoisier
status: experimental
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"
    TargetObject|endswith: '\SOFTWARE\Microsoft\NetSh'
  condition: selection
falsepositives:
- None
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  NewProcessName|endswith: '\netsh.exe'
  TargetObject|endswith: '\SOFTWARE\Microsoft\NetSh'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
NewProcessNameends_with
  • \netsh.exe corpus 28 (sigma 28)
TargetObjectends_with
  • \SOFTWARE\Microsoft\NetSh