attack_technique: T1546.007
display_name: 'Event Triggered Execution: Netsh Helper DLL'
atomic_tests:
- name: Netsh Helper DLL Registration
  auto_generated_guid: 3244697d-5a3a-4dfc-941c-550f69f91a4d
  description: |
    Netsh interacts with other operating system components using dynamic-link library (DLL) files
  supported_platforms:
  - windows
  input_arguments:
    helper_file:
      description: Path to DLL
      type: Path
      default: C:\Path\file.dll
  executor:
    command: |
      netsh.exe add helper #{helper_file}
    name: command_prompt