Processes launching netsh
This search looks for processes launching netsh.exe. Netsh is a command-line scripting utility that allows you to, either locally or remotely, display or modify the network configuration of a computer that is currently running. Netsh can be used as a persistence proxy technique to execute a helper DLL when netsh.exe is executed. In this search, we are looking for processes spawned by netsh.exe and executing commands via the command line.
This content is not mapped to any local saved search. Add mapping
Processes launching netsh Help
This search looks for all the parent processes of netsh.exe and returns that process, the command-line used to execute it, the host name, and the user context under which it ran.