detection.wiki

Detection rules › Sigma

New Netsh Helper DLL Registered From A Suspicious Location

Severity
high
Author
Nasreddine Bencherchali (Nextron Systems)
Source
upstream

Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper

MITRE ATT&CK coverage

TacticTechniques
PersistenceT1546.007 Event Triggered Execution: Netsh Helper DLL
Privilege EscalationT1546.007 Event Triggered Execution: Netsh Helper DLL

Event coverage

ProviderEvent IDTitle
Sysmon13RegistryEvent (Value Set)

Stages and Predicates

Stage 1: selection_target

TargetObject|contains: '\SOFTWARE\Microsoft\NetSh'

Stage 2: 1 of selection_folders_1

or:
Details|contains: ':\Perflogs\'
Details|contains: ':\Users\Public\'
Details|contains: ':\Windows\Temp\'
Details|contains: '\AppData\Local\Temp\'
Details|contains: '\Temporary Internet'

Stage 3: 1 of selection_folders_2

or:
Details|contains: ':\Users\'
Details|contains: '\Contacts\'
Details|contains: ':\Users\'
Details|contains: '\Favorites\'
Details|contains: ':\Users\'
Details|contains: '\Favourites\'
Details|contains: ':\Users\'
Details|contains: '\Pictures\'

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
Detailsmatch
  • :\Perflogs\ corpus 3 (sigma 3)
  • :\Users\ corpus 4 (sigma 4)
  • :\Users\Public\ corpus 4 (sigma 4)
  • :\Windows\Temp\ corpus 4 (sigma 4)
  • \AppData\Local\Temp\ corpus 9 (sigma 9)
  • \Contacts\ corpus 4 (sigma 4)
  • \Favorites\ corpus 3 (sigma 3)
  • \Favourites\ corpus 3 (sigma 3)
  • \Pictures\ corpus 3 (sigma 3)
  • \Temporary Internet corpus 3 (sigma 3)
TargetObjectmatch
  • \SOFTWARE\Microsoft\NetSh corpus 2 (sigma 2)

Neighbors

Stricter alternatives (narrower than this rule)

The rules below may be useful if you find the current rule is too noisy / lacks specificity.