CircleCI Atomic Red Team doc generator
35 lines
1.6 KiB
Markdown
35 lines
1.6 KiB
Markdown
# T1128 - Netsh Helper DLL
|
|
## [Description from ATT&CK](https://attack.mitre.org/wiki/Technique/T1128)
|
|
<blockquote>Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility. (Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>.
|
|
|
|
Adversaries can use netsh.exe with helper DLLs to proxy execution of arbitrary code in a persistent manner when netsh.exe is executed automatically with another Persistence technique or if other persistent software is present on the system that executes netsh.exe as part of its normal functionality. Examples include some VPN software that invoke netsh.exe. (Citation: Demaske Netsh Persistence)
|
|
|
|
Proof of concept code exists to load Cobalt Strike's payload using netsh.exe helper DLLs. (Citation: Github Netsh Helper CS Beacon)</blockquote>
|
|
|
|
## Atomic Tests
|
|
|
|
- [Atomic Test #1 - Netsh Helper DLL Registration](#atomic-test-1---netsh-helper-dll-registration)
|
|
|
|
|
|
<br/>
|
|
|
|
## Atomic Test #1 - Netsh Helper DLL Registration
|
|
Netsh interacts with other operating system components using dynamic-link library (DLL) files
|
|
|
|
**Supported Platforms:** Windows
|
|
|
|
|
|
#### Inputs
|
|
| Name | Description | Type | Default Value |
|
|
|------|-------------|------|---------------|
|
|
| helper_file | Path to DLL | Path | C:\Path\file.dll|
|
|
|
|
#### Run it with `command_prompt`!
|
|
```
|
|
netsh.exe add helper #{helper_file}
|
|
```
|
|
|
|
|
|
|
|
<br/>
|