S0108: netsh
Analyst context for executives and security teams
netsh is a legitimate Windows networking administration utility. Its security significance is that adversaries can blend into normal admin activity while changing network behavior, inspecting defensive software, configuring proxy-like traffic paths, modifying firewall behavior, or abusing Netsh helper DLL registration for persistence. For leaders, this is a living-off-the-land risk: the tool is expected to exist on Windows systems, so control quality depends on knowing which netsh activity is authorized, logged, and reviewed.
Executive priority
Prioritize netsh coverage where Windows systems support critical business services, remote administration, internet-facing recovery paths, or regulated audit evidence. Because ATT&CK links netsh to persistence, discovery, proxy, and firewall modification behaviors, security leaders should ask whether firewall changes, helper DLL registration, and unusual network configuration changes can be reconstructed during an incident. This is also relevant to ransomware and critical infrastructure readiness because the supplied relationships include a ransomware intrusion campaign and multiple threat groups/campaigns using the tool, but local risk should be based on the organization’s Windows exposure and administrative model.
Technical view
Validate netsh monitoring on Windows endpoints, especially command-line execution, parent/child process context, user identity, host role, and timing relative to other discovery or defense-impairment events. Relationship-driven areas to test include T1546.007 Netsh Helper DLL persistence via HKLM\SOFTWARE\Microsoft\Netsh, T1686 firewall disable/modify behavior, T1518.001 security software discovery, and T1090 proxy-related network configuration activity. Since ATT&CK provides no official detection text for this software object, detections should be built from local baselines of legitimate administrator and system management use rather than simple netsh execution alone.
Likely telemetry
- Windows process creation events for netsh.exe with full command-line arguments
- User, logon session, integrity level, and parent process context for netsh execution
- Windows Registry monitoring for HKLM\SOFTWARE\Microsoft\Netsh helper DLL registrations or changes
- Host firewall configuration change logs and policy change events
- Endpoint security or EDR telemetry showing network configuration changes
Detection direction
- Baseline normal netsh usage by administrators, management tools, and server roles before alerting on execution volume alone.
- Prioritize alerts for netsh launched by unusual parents, non-admin user contexts, temporary directories, remote shells, or scripting engines when supported by local telemetry.
- Monitor for new or modified Netsh helper DLL registry entries and correlate with file creation, unsigned or unexpected DLL paths, and subsequent netsh execution.
- Correlate netsh firewall changes with host firewall policy logs and change-management records; tune out known administrative maintenance windows.
- Look for netsh activity near security software discovery, firewall modification, or proxy/network redirection indicators, since those behaviors are linked by supplied ATT&CK relationships.
Mitigation priorities
- Define and document authorized netsh administrative use, including approved users, systems, and maintenance workflows.
- Restrict administrative privileges on Windows systems so routine users cannot modify firewall, network, or persistence-relevant settings.
- Enable and retain process command-line, registry, and firewall policy telemetry needed to investigate netsh activity.
- Use change control for firewall and network configuration changes on critical Windows assets.
- Review HKLM\SOFTWARE\Microsoft\Netsh for unexpected helper DLL registrations and incorporate it into persistence checks during incident response.
Analyst notes and limits
The materiality of netsh comes from its legitimate Windows administrative role combined with ATT&CK relationships to proxy, security software discovery, Netsh Helper DLL persistence, and firewall modification. The related campaigns and groups show that the tool has been observed in adversary tradecraft, but this take does not infer current activity or exposure in any specific environment.
The official ATT&CK object has a short description, Windows platform only, no aliases, no tactics listed on the software object, and no official detection guidance. Detection and mitigation recommendations therefore require local validation of Windows logging, administrative baselines, and change-management practices.
netsh
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Techniques used
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1686 | Disable or Modify System Firewall | netsh can be used to disable local firewall settings.CitationTechNet NetshCitationTechNet Netsh Firewall |
| Enterprise | T1546.007 | Netsh Helper DLL Sub-technique | netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed.CitationDemaske Netsh Persistence |
| Enterprise | T1090 | Proxy | netsh can be used to set up a proxy tunnel to allow remote host access to an infected host.CitationSecurelist fileless attacks Feb 2017 |
| Enterprise | T1518.001 | Security Software Discovery Sub-technique | netsh can be used to discover system firewall settings.CitationTechNet NetshCitationTechNet Netsh Firewall |
Groups, software, and campaigns
G1017: Volt Typhoon
Volt Typhoon is a People's Republic of China (PRC) state-sponsored actor that has been active since at least 2021, primarily targeting critical infrastructure organizations in the US and its territories including Guam. Volt Typhoon's targeting and pattern of behavior have been assessed as pre-positioning to enable lateral movement to operational technology (OT) assets for potential destructive or disruptive attacks. Volt Typhoon has emphasized stealth in operations using web shells, living-off-the-land (LOTL) binaries, hands on keyboard activities, and stolen credentials.[1][2][3][4]. The group has leveraged compromised SOHO routers to proxy command and control traffic and obscure its infrastructure, activity associated with the KV botnet.[5].
Reporting indicates a separate initial access cluster, SYLVANITE, has been observed exploiting internet-facing edge devices and transferring access to Volt Typhoon, also tracked as VOLTZITE, for follow-on operations. [6]
G0019: Naikon
Naikon is assessed to be a state-sponsored cyber espionage group attributed to the Chinese People’s Liberation Army’s (PLA) Chengdu Military Region Second Technical Reconnaissance Bureau (Military Unit Cover Designator 78020).[1] Active since at least 2010, Naikon has primarily conducted operations against government, military, and civil organizations in Southeast Asia, as well as against international bodies such as the United Nations Development Programme (UNDP) and the Association of Southeast Asian Nations (ASEAN).[1][2]
While Naikon shares some characteristics with APT30, the two groups do not appear to be exact matches.[3]
G0050: APT32
APT32 is a suspected Vietnam-based threat group that has been active since at least 2014. The group has targeted multiple private sector industries as well as foreign governments, dissidents, and journalists with a strong focus on Southeast Asian countries like Vietnam, the Philippines, Laos, and Cambodia. They have extensively used strategic web compromises to compromise victims.[1][2][3]
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
G0008: Carbanak
G0035: Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
C0018: C0018
C0018 was a month-long ransomware intrusion that successfully deployed AvosLocker onto a compromised network. The unidentified actors gained initial access to the victim network through an exposed server and used a variety of open-source tools prior to executing AvosLocker.[1][2]
C0051: APT28 Nearest Neighbor Campaign
APT28 Nearest Neighbor Campaign was conducted by APT28 from early February 2022 to November 2024 against organizations and individuals with expertise on Ukraine. APT28 primarily leveraged living-off-the-land techniques, while leveraging the zero-day exploitation of CVE-2022-38028. Notably, APT28 leveraged Wi-Fi networks in close proximity to the intended target to gain initial access to the victim environment. By daisy-chaining multiple compromised organizations nearby the intended target, APT28 discovered dual-homed systems (with both a wired and wireless network connection) to enable Wi-Fi and use compromised credentials to connect to the victim network.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.3 | Current bundle | 4abb9e060536… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
TechNet Netsh
Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.
Open source URL -
[2]
mitre-attack S0108Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.