Netsh Helper DLL abuse (MITRE ATT&CK T1546.007) is a Windows persistence and privilege escalation technique. Netsh.exe, also called Netshell, is a command-line utility for network configuration. It can load helper DLLs to extend what it does.
How attackers use it
The paths of registered helper DLLs are stored in the registry at HKLM\SOFTWARE\Microsoft\Netsh. MITRE explains that an adversary can add a DLL there so arbitrary code runs every time netsh.exe runs.
That can happen in several ways. Another persistence mechanism may call netsh. Other software on the machine, such as a VPN client, may call it as part of normal work. Either way the adversary does not need to start the process.
How to detect it
MITRE's detection strategy has two parts:
- Registry modifications under
HKLM\SOFTWARE\Microsoft\Netshthat add a helper DLL. - Unusual child processes or module loads from netsh.exe afterward.
MITRE notes these behaviors are rarely legitimate, which keeps the signal clean. Sysmon registry events (IDs 12, 13 and 14) are a common way to collect the first part.
How to reduce the risk
MITRE lists no specific mitigations for this technique. In practice, limit who can write to HKLM, keep a baseline of the helper DLLs on your standard builds, and alert on drift.
Quick check
Which registry location holds the helper DLL paths?
HKLM\SOFTWARE\Microsoft\Netsh. Any new value there that is not part of your baseline deserves investigation.
