Netsh Helper DLLs

DLLs loaded whenever netsh.exe runs, a tidy hook for a program that admins use.

Use it to find a DLL that loads every time netsh.exe runs, so its code runs inside a trusted Windows tool.

SOFTWARE
Persistence

What It Is

Netsh is a command-line tool for viewing and changing network settings. It works through helper DLLs, each of which adds a context, a group of commands for a networking service or protocol, such as the interface or firewall contexts. Netsh reads the list of installed helpers from the registry when it runs and loads them. The NetSh key in HKLM SOFTWARE holds that list of helper DLLs.

What It Proves

A DLL registered under the Netsh key is loaded every time netsh.exe starts. Attackers add one so their code runs under a legitimate networking tool.

What It Does Not Prove

It fires only when netsh.exe runs, which may be rarely or often depending on scripts and admin habits. Genuine helpers from Windows and some products also live here.

Where It Lives

Netsh Helper DLLs lives in the SOFTWARE hive, which holds settings for the whole machine. Offline Hive shows the path inside the hive file, as Registry Explorer opens it, and Live System shows the same key as regedit shows it on a running machine. The line under the path is where the hive file sits on disk.

SOFTWARE\Microsoft\Netsh

C:\Windows\System32\config\SOFTWARE

What It Looks Like

These are three values from this key on ws-042, the fictional machine the wiki follows, decoded into plain English. Each row shows the value as Windows stores it, its name, type and data, then what it tells you.

Values in Netsh Helper DLLs, each with what it tells you
Registry Value	What It Tells You
`dot3cfg` `REG_SZdot3cfg.dll`	dot3cfg.dll, the helper behind netsh lan, loads from System32 when netsh.exe runs. Resolve each helper the same way. One elsewhere is the signal.
`WcnNetsh` `REG_SZWcnNetsh.dll`	WcnNetsh.dll, the Windows Connect Now helper, ships with Windows. Compare the whole list with a clean build of the same version.
`hnetmon` `REG_SZhnetmon.dll`	hnetmon.dll, the helper behind netsh bridge, also ships in System32. An entry outside System32, or an unknown name, is the one to chase.

How to Read It

List the values under the Netsh key, each a DLL name loaded by netsh.exe. Resolve each name to a path and compare with the known Windows helpers. An entry pointing outside System32, or an unknown name, is the signal.

When Windows Writes It: When a helper is registered, by a product installer or an attacker.
Which Windows Versions: Windows XP to 11
Tools That Parse It: Autoruns, Registry Explorer, RECmd

Hunt It

Sees It DirectlyDeviceRegistryEvents

Microsoft does not say which keys Defender records, so confirm it records this one first. A hit shows a helper registered, not that netsh.exe loaded it.

KQLDefender XDR, Advanced hunting

// A helper DLL being registered under the Netsh keyDeviceRegistryEvents| where Timestamp > ago(30d)| where DeviceName startswith "ws-042"| where RegistryKey endswith @"\Microsoft\Netsh"| project Timestamp, ActionType, RegistryValueName, RegistryValueData, InitiatingProcessCommandLine

Confirm It With

One artefact can mislead on its own. These other records show the same activity, or pin down when it happened, so use them to back up what Netsh Helper DLLs shows.

netsh.exe Runs, Security Event 4688Not in the RegistryShows when netsh.exe ran, the only time the helper loads.
DLL Load, Sysmon Event 7Not in the RegistryShows the helper DLL loading into netsh.exe.

Sources

The facts on this page come from these public pages, which say more on each point.