Potential Persistence Via Netsh Helper DLL - Registry

Title: Potential Persistence Via Netsh Helper DLL - Registry
Status: test
Description:Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
References:
  -https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
  -https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
Author: Anish Bogati
Date: 2023-11-28
modified:2025-10-08
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.t1546.007'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\SOFTWARE\Microsoft\NetSh'
    Details|contains: '.dll'
  filter_main_poqexec:
    Image: 'C:\Windows\System32\poqexec.exe'
    Details:
      -'ipmontr.dll'
      -'iasmontr.dll'
      -'ippromon.dll'

  condition:selection and not 1 of filter_main_*
Falsepositives:
  -Legitimate helper added by different programs and the OS
Level: medium