Merge PR #4602 from @nasbench - Update Netsh DLL Helper Abuse Rules

update: Potential Persistence Via Netsh Helper DLL - Reduced severity and enhance metadata information
new: New Netsh Helper DLL Registered From A Suspicious Location
new: Potential Persistence Via Netsh Helper DLL - Registry

---------

Co-authored-by: phantinuss <79651203+phantinuss@users.noreply.github.com>

rules/windows/process_creation/proc_creation_win_netsh_helper_dll_persistence.yml

@@ -1,13 +1,20 @@
 title: Potential Persistence Via Netsh Helper DLL
 id: 56321594-9087-49d9-bf10-524fe8479452
+related:
+    - id: c90362e0-2df3-4e61-94fe-b37615814cb1
+      type: similar
+    - id: e7b18879-676e-4a0e-ae18-27039185a8e7
+      type: similar
 status: test
-description: Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
+description: |
+    Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.
 references:
     - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1546.007/T1546.007.md
-    - https://attack.mitre.org/software/S0108/
+    - https://github.com/outflanknl/NetshHelperBeacon
+    - https://web.archive.org/web/20160928212230/https://www.adaptforward.com/2016/09/using-netshell-to-execute-evil-dlls-and-persist-on-a-host/
 author: Victor Sergeev, oscd.community
 date: 2019/10/25
-modified: 2023/02/14
+modified: 2023/11/28
 tags:
     - attack.privilege_escalation
     - attack.persistence
@@ -17,17 +24,14 @@ logsource:
     category: process_creation
     product: windows
 detection:
-    selection:
-        Image|endswith: '\netsh.exe'
+    selection_img:
+        - OriginalFileName: 'netsh.exe'
+        - Image|endswith: '\netsh.exe'
+    selection_cli:
         CommandLine|contains|all:
             - 'add'
             - 'helper'
-    condition: selection
-fields:
-    - ComputerName
-    - User
-    - CommandLine
-    - ParentCommandLine
+    condition: all of selection_*
 falsepositives:
     - Unknown
-level: high
+level: medium

rules/windows/registry/registry_set/registry_set_netsh_help_dll_persistence_susp_location.yml

@@ -0,0 +1,48 @@
+title: New Netsh Helper DLL Registered From A Suspicious Location
+id: e7b18879-676e-4a0e-ae18-27039185a8e7
+related:
+    - id: 56321594-9087-49d9-bf10-524fe8479452
+      type: similar
+    - id: c90362e0-2df3-4e61-94fe-b37615814cb1
+      type: similar
+status: experimental
+description: |
+    Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
+references:
+    - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
+    - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
+author: Nasreddine Bencherchali (Nextron Systems)
+date: 2023/11/28
+tags:
+    - attack.persistence
+    - attack.t1546.007
+logsource:
+    category: registry_set
+    product: windows
+detection:
+    selection_target:
+        TargetObject|contains: '\SOFTWARE\Microsoft\NetSh'
+    selection_folders_1:
+        Details|contains:
+            - ':\Perflogs\'
+            - ':\Users\Public\'
+            - ':\Windows\Temp\'
+            - '\AppData\Local\Temp\'
+            - '\Temporary Internet'
+    selection_folders_2:
+        - Details|contains|all:
+              - ':\Users\'
+              - '\Favorites\'
+        - Details|contains|all:
+              - ':\Users\'
+              - '\Favourites\'
+        - Details|contains|all:
+              - ':\Users\'
+              - '\Contacts\'
+        - Details|contains|all:
+              - ':\Users\'
+              - '\Pictures\'
+    condition: selection_target and 1 of selection_folders_*
+falsepositives:
+    - Unknown
+level: high

rules/windows/registry/registry_set/registry_set_netsh_helper_dll_potential_persistence.yml

@@ -0,0 +1,29 @@
+title: Potential Persistence Via Netsh Helper DLL - Registry
+id: c90362e0-2df3-4e61-94fe-b37615814cb1
+related:
+    - id: 56321594-9087-49d9-bf10-524fe8479452
+      type: similar
+    - id: e7b18879-676e-4a0e-ae18-27039185a8e7
+      type: similar
+status: experimental
+description: |
+    Detects changes to the Netsh registry key to add a new DLL value. This change might be an indication of a potential persistence attempt by adding a malicious Netsh helper
+references:
+    - https://www.ired.team/offensive-security/persistence/t1128-netsh-helper-dll
+    - https://pentestlab.blog/2019/10/29/persistence-netsh-helper-dll/
+author: Anish Bogati
+date: 2023/11/28
+tags:
+    - attack.persistence
+    - attack.t1546.007
+logsource:
+    category: registry_set
+    product: windows
+detection:
+    selection:
+        TargetObject|contains: '\SOFTWARE\Microsoft\NetSh'
+        Details|contains: '.dll'
+    condition: selection
+falsepositives:
+    - Legitimate helper added by different programs and the OS
+level: medium