netsh.exe
Sources: 300M+ executions observed in the wild.
Summary
Network Shell (netsh.exe) is a command-line utility for viewing and configuring network settings on Windows. It can manage firewall rules, network interfaces, IP addresses, wireless profiles, and many other network-related configurations. It supports a context-based command structure with helper DLLs.
netsh.exe is the 26th most commonly executed Windows program in EchoTrail's dataset, observed 2,157,937 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Get this in your tools
The same record for netsh.exe, by REST or as an MCP tool. Free key, no card.
curl -H "Authorization: Bearer $ECHOTRAIL_KEY" \
https://api.echotrail.io/v1/process/netsh.exeFree returns the summary. Team returns the full record you see on this page. Endpoint docs
Behavior
Top Paths
- C:\Windows\System3296.63%
- C:\Windows\SysWOW643.37%
Top Hashes (SHA256)
- 6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a984.17%
- 41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee0144.41%
- 71131c1535887fac329edca024dbed4c6a2bdc4f9e91ce2443ee3590165218362.25%
- 9efa9dafa09ae9ba6390a8f0f6751006c18a98b6692667ca08367cddb47ac6341.87%
- d70d165b6706c61c56f2ca91307f4bbdb9846acae1da3cfd84bf978ffb21af231.29%
- 0427f35170e8038e1dd7c913bfd7784ae539245c2faa0e1270056920fd41c22a1.12%
- 7482890b1875bdcec826f3385eac7dcdc38f17358a13b1b8c790bdb895ff50541.08%
- e5888e649c881e4bbbce472f6808f93b2b5564d3094995a5a08e66b2406c16070.96%
- 6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb0.7%
- 751525ff60a42609d4dfcbb9d70cec0c0650fc2b14b04994ede1b0159688278b0.51%
Process Ancestry
Top Grandparents
- LTSVC.exe80.24%
- PanGPS.exe3.76%
- services.exe0.7%
- PanGpHip.exe0.21%
- msiexec.exe0.15%
- explorer.exe0.14%
- LTClient.exe0.11%
- Uninstall.exe0.07%
- SUService.exe0.06%
- remsh.exe0.03%
Top Parents
- cmd.exe7.29%
- powershell.exe5.01%
- LTSVC.exe0.21%
- Dropbox.exe0.05%
- CcmExec.exe0.03%
Top Children
- conhost.exe100%
- netsh.exe<0.01%
- net1.exe<0.01%
Security Analysis
What does netsh.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Commonly launched by application installers (SolsticeClient.exe accounts for the majority in this dataset), cmd.exe, powershell.exe, and VPN clients (FortiSSLVPNdaemon.exe). Spawns conhost.exe. Used for network diagnostics, firewall configuration, and interface management.
When is netsh.exe suspicious?
Firewall rule manipulation: netsh advfirewall firewall add/delete/set — especially disabling the firewall or adding allow rules for suspicious ports or programs. Port proxy/forwarding configuration: netsh interface portproxy. Wireless profile extraction: netsh wlan show profile key=clear. Loading helper DLLs: netsh add helper <malicious.dll>. Spawned by unusual parents like Office applications, w3wp.exe, or script interpreters.
How do attackers abuse netsh.exe?
Firewall manipulation: attackers disable Windows Firewall or add rules to allow C2 traffic (netsh advfirewall set allprofiles state off). Port forwarding: netsh interface portproxy creates port forwarding rules for lateral movement or C2 tunneling. Helper DLL persistence: netsh can load arbitrary DLLs via the helper DLL mechanism, providing persistence that survives reboots. WiFi credential theft: netsh wlan show profile key=clear dumps stored WiFi passwords in plaintext.
Detection guidance
High-confidence: netsh advfirewall set ... state off (disabling firewall). netsh add helper (DLL loading for persistence). netsh interface portproxy (port forwarding). netsh wlan show profile key=clear (credential theft). Medium-confidence: any netsh firewall rule modifications outside of known software installation windows. Correlate timing with software installation or configuration management activity.
False positive notes
Application installers frequently configure firewall rules via netsh during installation (SolsticeClient, VPN clients, conferencing software). FortiClient and other VPN products use netsh for network interface configuration. Management agents may query network configuration via netsh for health checks.
Related Processes
Ask Rocky about netsh.exe
Rocky is the free chat demo. It answers from this same dataset, no account needed.
This page is the Team-tier API record for netsh.exe. The free tier returns the summary, 500 lookups a month. Or ask Rocky.