tool

netsh S0108

Type: tool
Platform: Windows
Created: 31 May 2017
Last modified: 25 February 2025

netsh is a scripting utility used to interact with networking components on local or remote systems. [1]

TechniquesBottom 17%

Tactics41st pct

Threat groupsunranked

Campaignsunranked

Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.

Standing S0108

Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.

Select	Description	Category	Status	Event	OS	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs
	All TCP traffic on particular port from attacker is routed to different port. (...)	Generic	test	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify System Firewall	-	medium	Rafal Piasecki	2022-08-10	—	70b4156e-50fc-4523-aa50-c9dddf1993fc
Splunk	This analytic detects creation of a Cisco IOS-XE tunnel interface with tunnel source, tunnel destination, and an IP address in the 10.10.12.0 network. (...)	Anomaly	stable	network_device	-	Cisco IOS · Cisco	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Nasreddine Bencherchali	2026-05-19	2026-05-20	8654314d-8e4d-4971-9f35-b9d477bf668e
	Detects execution of the "cloudflared" tool with the tunnel "cleanup" flag in order to cleanup tunnel connections.	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-21	7050bba1-1aed-454e-8f73-3f46f09ce56a
	Detects execution of the "cloudflared" tool to connect back to a tunnel. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Janantha Marasinghe, Nasreddine Bencherchali (Nextron Systems)	2023-05-17	2023-12-20	9a019ffc-3580-4c9d-8d87-079f7e8d3fd4
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	3ab65069-d82a-4d44-a759-466661a082d1
	Detects an executable initiating a network connection to "LocaltoNet" tunneling sub-domains. (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Andreas Braathen (mnemonic.io)	2024-06-17	—	c4568f5d-131f-4e78-83d4-45b2da0ec4f1
	Detects an executable accessing an ngrok tunneling endpoint, which could be a sign of forbidden exfi (...)	Generic	test	network_connection	linux	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	—	19bf6fdb-7721-4f3d-867f-53467f6a5db6
	Detects an executable initiating a network connection to "ngrok" tunneling domains. (...)	Generic	test	network_connection	windows	Sysmon	Command and Control Dynamic Resolution Domain Generation Algorithms Exfiltration Exfiltration Over Web Service Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	high	Florian Roth (Nextron Systems)	2022-11-03	2024-02-02	1d08ac94-400d-4469-a82f-daee9a908849
	Detects setting proxy configuration	Generic	test	process_creation	linux	Sysmon	Command and Control Proxy	-	low	Ömer Günal	2020-06-17	2022-10-05	72f4ab3f-787d-495d-a55d-68c2ff46cf4c	-
	Detects disabling of system firewalls which could be used by adversaries to bypass controls that limit usage of the network.	Generic	test	service	linux	Linux Auditd	Defense Impairment Disable or Modify System Firewall	-	high	Pawel Mazur	2022-01-22	—	53059bc0-1472-438b-956a-7508a94a91f0
	Detects disabling security tools	Generic	test	process_creation	linux	Sysmon	Defense Impairment Disable or Modify System Firewall	-	medium	Ömer Günal, Alejandro Ortuno, oscd.community	2020-06-17	2022-10-09	e3a8a052-111f-4606-9aee-f28ebeb76776
	Detects disabling security tools	Generic	test	-	linux	Syslog	Defense Impairment Disable or Modify System Firewall	-	medium	Ömer Günal, Alejandro Ortuno, oscd.community	2020-06-17	2022-11-26	49f5dfc1-f92e-4d34-96fa-feba3f6acf36
Splunk	This detection identifies when the ESXi firewall is disabled or set to permissive mode, which can expose the host to unauthorized access and network-based attacks. (...)	Generic	stable	-	esxi	VMware ESXi · VMware	Defense Impairment Disable or Modify System Firewall	-	medium	Raven Tait, Splunk	2025-07-11	2026-05-13	e321804c-8eb5-42f2-a843-36b289a6c6b2	-
Splunk	The following analytic detects the modification of a firewall rule to allow the execution of a specific application. (...)	Anomaly	stable	process_creation	windows	Sysmon · WinEventLog Security · CrowdStrike	Defense Impairment Disable or Modify System Firewall	-	medium	Teoderick Contreras, Splunk	2021-11-17	2026-06-08	9a8f63a8-43ac-11ec-904c-acde48001122
	Detect use of iptables to flush all firewall rules, tables and chains and allow all network traffic	Generic	test	process_creation	linux	Sysmon	Defense Impairment Disable or Modify System Firewall	-	medium	Joseliyo Sanchez, @Joseliyo_Jstnk	2023-01-18	—	3be619f4-d9ec-4ea8-a173-18fdd01996ab
	Detects executable names or flags used by Htran or Htran-like tools (e.g. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-12-27	2023-02-04	f5e3b62f-e577-4e59-931e-0a15b2b94e1e
	Detects the execution of the "curl.exe" command, referencing "SOCKS" and ".onion" domains, which could be indicative of Kalambur backdoor activity.	Emerging	experimental	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Application Layer Protocol Web Protocols Execution Command and Scripting Interpreter PowerShell Command and Control Encrypted Channel Command and Control Proxy	-	high	Arda Buyukkaya (EclecticIQ)	2025-02-11	—	e99375eb-3ee0-407a-9f90-79569cc6a01c
Splunk	The following analytic detects the suspicious disable or modify system firewall. (...)	Anomaly	stable	service	linux	Linux Auditd	Defense Impairment Disable or Modify System Firewall	-	medium	Teoderick Contreras, Splunk	2024-08-12	2026-05-13	07052556-d4b5-4bae-89aa-cbdc1bb11250
Splunk	The following analytic detects suspicious command-line activity that modifies the iptables firewall settings on a Linux machine. (...)	Anomaly	stable	process_creation	linux	Sysmon	Defense Impairment Disable or Modify System Firewall	-	medium	Teoderick Contreras, Splunk	2022-04-07	2026-05-13	309d59dc-1e1b-49b2-9800-7cf18d12f7b7
Splunk	The following analytic detects the use of Ngrok on a Linux operating system. (...)	Anomaly	stable	process_creation	linux	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Michael Haag, Splunk	2023-01-12	2026-05-13	bc84d574-708c-467d-b78a-4c1e20171f97
Splunk	The following analytic detects the use of the `curl` command with proxy-related arguments such as `-x`, `socks`, `--preproxy`, and `--proxy`. (...)	Generic	stable	process_creation	linux	Sysmon	Command and Control Non-Application Layer Protocol Command and Control Proxy	-	medium	Michael Haag, Splunk, 0xC0FFEEEE, Github Community	2022-07-29	2026-06-04	bd596c22-ad1e-44fc-b242-817253ce8b08
Splunk	The following analytic detects command-line activities that redirect stdout or stderr to the /dev/null file. (...)	Anomaly	stable	process_creation	linux	Sysmon	Defense Impairment Disable or Modify System Firewall	-	medium	Teoderick Contreras, Splunk	2022-04-07	2026-05-13	de62b809-a04d-46b5-9a15-8298d330f0c8
	Detects execution of "Get-NetFirewallRule" or "Show-NetFirewallRule" to enumerate the local firewall rules on a host.	Hunting	test	ps_module	windows	PowerShell	Discovery Software Discovery Security Software Discovery Discovery System Network Configuration Discovery	-	low	Christopher Peacock @SecurePeacock, SCYTHE @scythe_io	2023-07-13	—	ea207a23-b441-4a17-9f76-ad5be47d51d3
	Indicates sign-in from a malicious IP address based on high failure rates.	Generic	test	-	-	Azure Risk Detection · Azure	Command and Control Proxy	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-07	—	a3f55ebd-0c01-4ed6-adc0-8fb76d8cd3cd
	Indicates sign-in from a malicious IP address known to be malicious at time of sign-in.	Generic	test	-	-	Azure Risk Detection · Azure	Command and Control Proxy	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-07	—	36440e1c-5c22-467a-889b-593e66498472
Splunk	Microsoft Intune device management configuration policies are a tool administrators can use to remotely manage policies and settings on intune managed devices. (...)	Hunting	stable	cloud_audit	-	Azure	Defense Impairment Disable or Modify System Firewall Defense Impairment Disable or Modify Tools Privilege Escalation, Defense Impairment Domain or Tenant Policy Modification Lateral Movement Remote Services Cloud Services Execution, Lateral Movement Software Deployment Tools	-	medium	Dean Luxton	2025-01-06	2026-05-13	3c49e5ed-625c-408c-a2c7-8e2b524efb2c
	Detects the removal of system firewall rules. (...)	Generic	test	process_creation	linux	Linux Auditd	Defense Impairment Disable or Modify System Firewall	-	medium	IAI	2023-03-06	2025-10-12	323ff3f5-0013-4847-bbd4-250b5edb62cc
	Detects changes to the Netsh registry key to add a new DLL value that is located on a suspicious location. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL	-	high	Nasreddine Bencherchali (Nextron Systems)	2023-11-28	—	e7b18879-676e-4a0e-ae18-27039185a8e7
	Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	medium	Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel	2019-01-29	2023-09-01	322ed9ec-fcab-4f67-9a34-e7c6aef43614
	Detects the modification of the PortProxy registry key which is used for port forwarding.	Generic	test	registry_event	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	medium	Andreas Hunkeler (@Karneades)	2021-06-22	2024-03-25	a54f842a-3713-4b45-8c84-5f136fdebd3c
Splunk	The following analytic detects DNS queries to common Ngrok domains, indicating potential use of the Ngrok reverse proxy tool. (...)	Anomaly	stable	dns	windows	Sysmon	Command and Control Protocol Tunneling Command and Control Proxy Command and Control Web Service	-	medium	Michael Haag, Splunk	2022-11-16	2026-05-13	5790a766-53b8-40d3-a696-3547b978fcf0
	Detects cases in which ngrok, a reverse proxy tool, forwards events to the local RDP port, which cou (...)	Generic	test	-	windows	Terminal Services	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-04-29	—	64d51a51-32a6-49f0-9f3d-17e34d640272
Splunk	Remote Employment Fraud (REF) actors will often use virtual private networks (VPNs) to conceal their true physical location. (...)	Generic	experimental	authentication	-	Okta	Command and Control Protocol Tunneling Command and Control Proxy Initial Access, Persistence, Privilege Escalation, Stealth Valid Accounts	-	medium	Marissa Bower, Raven Tait	2025-06-12	2026-05-13	58eb9f80-896c-42f8-86c6-27ab59026c9c	-
	Detects instances where an HTTPPROXY service on an OpenCanary node has had an attempt to proxy another page.	Generic	test	-	-	OpenCanary	Command and Control Proxy	-	high	Security Onion Solutions	2024-03-08	—	5498fc09-adc6-4804-b9d9-5cca1f0b8760
	Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL	-	medium	Victor Sergeev, oscd.community	2019-10-25	2023-11-28	56321594-9087-49d9-bf10-524fe8479452
	Detects changes to the Netsh registry key to add a new DLL value. (...)	Generic	test	registry_set	windows	Sysmon · WinEventLog Security	Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL	-	medium	Anish Bogati	2023-11-28	2025-10-08	c90362e0-2df3-4e61-94fe-b37615814cb1
	Detects potential suspicious behaviour using secedit.exe. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Credential Access, Collection Adversary-in-the-Middle Persistence, Privilege Escalation Boot or Logon Autostart Execution Registry Run Keys / Startup Folder Authentication Package Port Monitors Active Setup Defense Impairment Disable or Modify Tools Disable or Modify Windows Event Log Persistence, Privilege Escalation Event Triggered Execution Netsh Helper DLL Accessibility Features Stealth Hide Artifacts Hidden Users Execution, Stealth Hijack Execution Flow Path Interception by PATH Environment Variable Persistence, Defense Impairment, Credential Access Modify Authentication Process Password Filter DLL Persistence Server Software Component Terminal Services DLL Discovery System Information Discovery	-	medium	Janantha Marasinghe	2022-11-18	2022-12-30	c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
	Detects potentially suspicious execution of the Qemu utility in a Windows environment. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Protocol Tunneling Command and Control Proxy	-	medium	Muhammad Faisal (@faisalusuf), Hunter Juhan (@threatHNTR)	2024-06-03	—	5fc297ae-25b6-488a-8f25-cc12ac29b744
	Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.	Generic	experimental	process_creation	windows	Sysmon · WinEventLog Security	Discovery Software Discovery Security Software Discovery	-	low	Tom3306	2026-08-19	—	f14b1e99-5e53-4598-98dc-6f20ad7b35e0
	Detects the use of Fast Reverse Proxy. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	frack113, Florian Roth	2022-09-02	2024-11-23	32410e29-5f94-4568-b6a3-d91a8adad863
	Detects the use of NPS, a port forwarding and intranet penetration proxy server	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-10-08	2024-11-23	68d37776-61db-42f5-bf54-27e87072d17e
	Detects the use of IOX - a tool for port forwarding and intranet proxy purposes	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems)	2022-10-08	2024-11-23	d7654f02-e04b-4934-9838-65c46f187ebc
	Detects the execution of netsh to configure a port forwarding of port 3389 (RDP) rule	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Command and Control Proxy	-	high	Florian Roth (Nextron Systems), oscd.community	2019-01-29	2023-02-13	782d6f3e-4c5d-4b8c-92a3-1d05fed72e63
	Detects usage of system utilities (only grep and egrep for now) to discover security software discov (...)	Generic	test	process_creation	linux	Sysmon	Discovery Software Discovery Security Software Discovery	-	low	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-27	c9d8b7fd-78e4-44fe-88f6-599135d46d60
	Detects usage of system utilities (only grep for now) to discover security software discovery	Generic	test	process_creation	macos	-	Discovery Software Discovery Security Software Discovery	-	medium	Daniil Yugoslavskiy, oscd.community	2020-10-19	2022-11-27	0ed75b9c-c73b-424d-9e7d-496cd565fbe0
	Detects calls to "get-process" where the output is piped to a "where-object" filter to search for security solution processes. (...)	Generic	test	ps_script	windows	PowerShell	Discovery Software Discovery Security Software Discovery	-	medium	frack113, Anish Bogati, Nasreddine Bencherchali (Nextron Systems)	2021-12-16	2023-10-24	904e8e61-8edf-4350-b59c-b905fc8e810c
	Detects execution of "findstr" to search for common names of security tools. (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Software Discovery Security Software Discovery	CVE-2023-42793	medium	Nasreddine Bencherchali (Nextron Systems), frack113	2023-10-20	2023-11-14	4fe074b4-b833-4081-8f24-7dcfeca72b42
	Indicates sign-ins from IP addresses infected with malware that is known to actively communicate with a bot server.	Generic	test	-	-	Azure Risk Detection · Azure	Command and Control Proxy	-	high	Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'	2023-09-03	—	821b4dc3-1295-41e7-b157-39ab212dd6bd
	Detects powershell scripts that creates sockets/listeners which could be indicative of tunneling act (...)	Generic	test	ps_script	windows	PowerShell	Command and Control Proxy	-	medium	Nasreddine Bencherchali (Nextron Systems)	2022-07-08	—	bd33d2aa-497e-4651-9893-5c5364646595
	Detects usage of "findstr" with the argument "385201". (...)	Generic	test	process_creation	windows	Sysmon · WinEventLog Security	Discovery Software Discovery Security Software Discovery	-	high	frack113	2021-12-16	2023-11-14	37db85d1-b089-490a-a59a-c7b6f984f480

Title

Description

netsh S0108

netsh MITRE reference S0108

Standing S0108

Reach

Coverage

netsh detections S0108