netsh is a scripting utility used to interact with networking components on local or remote systems.
| Technique | Procedure example |
|---|---|
| T1090 Proxy |
netsh can be used to set up a proxy tunnel to allow remote host access to an infected host. |
| T1518.001 Security Software Discovery |
netsh can be used to discover system firewall settings. |
| T1546.007 Netsh Helper DLL |
netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. |
| T1686 Disable or Modify System Firewall |
netsh can be used to disable local firewall settings. |
Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.
