Identifier / Programs / Windows
netsh.exe
Network shell (netsh) is a versatile and comprehensive command-line utility for configuring, managing, and monitoring network components and server roles on Windows and Windows Server systems. Windows commands reference
LOLBAS Execute 19 Sigma rules name it 5 ATT&CK techniques 1 documented command 12 known copies with hashes
How netsh.exe is abused
Execute T1546.007 Event Triggered Execution: Netsh Helper DLL
add helper
Each abuse is LOLBAS's category and the options and words it uses; the full write-up is on LOLBAS's page for netsh.exe.
1 documented command
Execute T1546.007 Event Triggered Execution: Netsh Helper DLL Admin privileges
Use Netsh in order to execute a .dll file and also gain persistence, every time the netsh command is called
netsh.exe add helper {PATH_ABSOLUTE:.dll}Trips 1 Sigma rule: mediumPotential Persistence Via Netsh Helper DLL by Victor Sergeev, oscd.community
The command the identifier reads trips a Sigma process-creation rule. These commands and their descriptions are from LOLBAS’s entry for netsh.exe, by Freddie Barr-Smith, at commit 2056cb766250 of 2026-09-26, under the GPL-3.0 and LOLBAS’s notice, with no warranty. Changed: Markdown is shown formatted. The source is in lolbas-gtfobins-commands.json.gz, and the full entry is on LOLBAS’s page for netsh.exe. The identifier reads it with LOLBAS’s placeholders filled in: a URL as https://example.com/file, a share as \\192.0.2.10\share\file, a path as C:\Data\file and a command as calc.exe.
What detects it
Is it the real netsh.exe?
C:\Windows\system32\C:\Windows\SysWOW64\12 known copies
10.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\netsh.exe · signed by Microsoft Windows
53cfae69bb8b4179bfbd217216bf41eedaffc793998f87a6e476257fae1690b910.0.22000.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\netsh.exe · signed by Microsoft Windows
b8f9a8275d946f40ef9c8ba5dbde244ef73f3f280146fae5454e2368628afdae10.0.19041.1 (WinBuild.160101.0800) · C:\Windows\system32\netsh.exe · signed by Microsoft Windows
6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a910.0.19041.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netsh.exe · signed by Microsoft Windows
9efa9dafa09ae9ba6390a8f0f6751006c18a98b6692667ca08367cddb47ac63410.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\system32\netsh.exe · signed by Microsoft Windows
90f0822d26680c8ffd703a080c876f87695580747a3704c169e39e1a8802ea3810.0.18362.1 (WinBuild.160101.0800) · C:\WINDOWS\SysWOW64\netsh.exe · signed by Microsoft Windows
e04fb93a81c7c469ba16cefd9b5b1fc355e86465ff24ea7b9c3fab5c52ab2f7d10.0.17763.1 (WinBuild.160101.0800) · C:\Windows\SysWOW64\netsh.exe · signed by Microsoft Windows
c94d41b92d051c1d7f30fc60196958799b4acff3fa2a2cdf8ced9d0b8b42b58310.0.17763.1 (WinBuild.160101.0800) · C:\Windows\system32\netsh.exe · signed by Microsoft Windows
d70d165b6706c61c56f2ca91307f4bbdb9846acae1da3cfd84bf978ffb21af2310.0.14393.0 (rs1_release.160715-1616) · C:\Windows\SysWOW64\netsh.exe · signed by Microsoft Windows
00b424fce60e8c3abb5bc05e2e1c4d86f14b07db48d08660a5a7bb25fc9e3c2310.0.14393.0 (rs1_release.160715-1616) · C:\Windows\system32\netsh.exe · signed by Microsoft Windows
e5888e649c881e4bbbce472f6808f93b2b5564d3094995a5a08e66b2406c16076.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\SysWOW64\netsh.exe · not signed
3fee0c58334856837b41b201c03dd974ae293ae6bcca96a38d6066d159b3534a6.3.9600.16384 (winblue_rtm.130821-1623) · C:\windows\system32\netsh.exe · not signed
71131c1535887fac329edca024dbed4c6a2bdc4f9e91ce2443ee359016521836From the file’s version info and the copies recorded by xCyclopedia (MIT). A copy in another folder, signed by someone else or with another hash is not necessarily malicious, but it is worth a closer look. In Ceplin, "<sha256>".whatis() says which known copy a hash is.
Everyday use
Add a helper Dynamic Link Library (DLL)
netsh add helper path\to\file.dllIdentifyTrips 1 Sigma rule: mediumPotential Persistence Via Netsh Helper DLL by Victor Sergeev, oscd.community
Matches LOLBAS abuse: Execute (T1546.007)
Show all loaded helper DLLs
netsh show helperIdentifyDelete a helper DLL
netsh delete helper path\to\file.dllIdentifyOf the 3 examples the identifier reads, 1 matches LOLBAS abuse or trips a Sigma process-creation rule.
Options
Show every option of netsh.exe
-aSpecifies that you want to return to the netsh shell after running an alias file.-cEnters the specified netsh context.-rSpecifies that you want the command to run on a remote computer using its computer name, a fully qualified domain name (FQDN), or IP address.-uSpecifies that you want to run the netsh command under a specific user account using DomainName\Username format.-pSpecifies that you want to provide a password for the user account.-fSpecifies that you want to exit netsh after executing the commands from the script file you provide.