Netsh Helper DLL (T1128)

View on ATT&CK

In Playbook

Technique & Subtechniques

  • Netsh Helper DLL

Associated Tactics

  • Persistence

Persistence (TA0003)

The adversary is trying to maintain their foothold. Persistence consists of techniques that adversaries use to keep access to systems across restarts, changed credentials, and other interruptions that could cut off their access. Techniques used for persistence include any access, action, or configuration changes that let them maintain their foothold on systems, such as replacing or hijacking legitimate code or adding startup code.

View on ATT&CK

Procedure Examples

Description Source(s)
Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017. TechNet Netsh
Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017. Demaske Netsh Persistence
Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved February 13, 2017. Github Netsh Helper CS Beacon