HUNTS- Netsh Helper DLL (T1128)
HUNTS- Netsh Helper DLL (T1128)
Version 1.0
ATT&CK Technique: Netsh Helper DLL (T1128)
What this playbook hunts for:
-
Modifications and creation of Netsh Helper DLL registry keys . Netsh.exe is a network configuration utility native to Windows environments. Attackers can modify Netsh registry keys to enable DLL loads each time Netsh.exe is executed. This serves as both a persistence and execution mechanism. Netsh.exe is an example of a Living of the Land (LOL) binary, which are native Windows executables that are rarely blocked by Applocker or anti-virus software.
-
Processes spawned by Netsh.exe. Netsh.exe can be used to load malicious DLL files.
How the playbook works:
-
Generates SIEM query for Sysmon Event ID 1 logs where netsh.exe is the parent process of an executed file
-
Generates SIEM query for Sysmon Event ID 12 and 13 logs where a HKLM\SOFTWARE\Microsoft\NetSh\ registry key is added or modified
What results are expected:
-
Name, process ID, and path of the process spawned by netsh.exe
-
Registry key modified
-
Registry value added
-
MD5 hash of the process spawned by netsh.exe
-
Child process spawn time
-
Hostname of the computer where netsh.exe was executed
-
User account that was used to execute netsh.exe
Common follow-on actions:
-
Acquire forensic image
-
Sandbox file
-
Get running processes
-
Get network connections
-
Quarantine host
What inputs are necessary:
-
SIEM
-
Logs: Sysmon Event ID 1: Process creation
-
Logs: Sysmon Event ID 12: RegistryEvent (Object create and delete)
-
Logs: Sysmon Event ID 13: RegistryEvent (Value Set)
-
Hunt start time
What subroutine playbooks are needed:
-
Create and Link Alerts from Hunt (Host-based)
What configurations are needed:
-
Sysmon EVENT ID 12 & 13 & 14 logging enabled with the following configuration added:
<RegistryEvent onmatch="include">
<TargetObject condition="begin with">HKLM\SOFTWARE\Microsoft\Netsh</TargetObject>
</RegistryEvent>
False Positive Potential: Medium-Low
-
Creation and modification of Netsh Helper DLL registry keys is fairly uncommon on most networks. Initial installs and updates of some VPN clients may trigger modifications to Netsh Helper DLL registry keys. Specific key values should be whitelisted if known to be benign.
