Netsh Helper DLL Registered for Persistence
This rule detects attempts to register a Netsh helper DLL for persistence. Netsh (Network Shell) is a command-line scripting utility that allows you to display or modify the network configuration of a locally running computer. Attackers can abuse the 'add helper' command to register a malicious DLL, which will then be loaded by Netsh whenever it runs, providing a persistence mechanism. The rule specifically looks for TCP traffic on port 445 (SMB) containing the strings "netsh" and "add helper" in a case-insensitive manner, indicating an attempt to use this technique.
Suricata
