Adversaries may establish persistence by executing malicious content triggered by Netsh Helper DLLs. Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system. It contains functionality to add helper DLLs for extending functionality of the utility.(Citation: TechNet Netsh) The paths to registered netsh.exe helper DLLs are entered into the Windows Registry at <code>HKLM\SOFTWARE\Microsoft\Netsh</code>.

Adversaries can use netsh.exe helper DLLs to trigger execution of arbitrary code in a persistent manner. This execution would take place anytime netsh.exe is executed, which could happen automatically, with another persistence technique, or if other software (ex: VPN) is present on the system that executes netsh.exe as part of its normal functionality.(Citation: Github Netsh Helper CS Beacon)(Citation: Demaske Netsh Persistence)
Netsh Helper DLL
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1546/007  external_id: T1546.007     source_name: Demaske Netsh Persistence  description: Demaske, M. (2016, September 23). USING NETSHELL TO EXECUTE EVIL DLLS AND PERSIST ON A HOST. Retrieved April 8, 2017.  url: https://htmlpreview.github.io/?https://github.com/MatthewDemaske/blogbackup/blob/master/netshell.html     source_name: TechNet Netsh  description: Microsoft. (n.d.). Using Netsh. Retrieved February 13, 2017.  url: https://technet.microsoft.com/library/bb490939.aspx     source_name: Github Netsh Helper CS Beacon  description: Smeets, M. (2016, September 26). NetshHelperBeacon. Retrieved February 13, 2017.  url: https://github.com/outflankbv/NetshHelperBeacon     