Skip to content

netsh

Software · ATTACK:enterprise:S0108

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:S0108",
  "title": "netsh",
  "type": "Software",
  "source_url": "https://attack.mitre.org/software/S0108",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "tool--5a63f900-5e7e-4928-a746-dd4558e1df71",
  "external_id": "S0108",
  "domain": "enterprise",
  "created": "2017-05-31T21:33:06.083Z",
  "modified": "2025-02-25T17:54:17.038Z",
  "version": "1.3",
  "aliases": [

  ],
  "tactics": [

  ],
  "source_references": [
    {
      "source_name": "TechNet Netsh",
      "url": "https://technet.microsoft.com/library/bb490939.aspx"
    }
  ]
}

Explicit source assertions (13)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--02e4c994-181d-4aaf-801b-a56ab36a1aaa

CISA AA24-038A PRC Critical Infrastructure February 2024 · Microsoft Volt Typhoon May 2023 · Joint Cybersecurity Advisory Volt Typhoon June 2023

ATTACK:enterprise:C0018 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--10e7df4a-c95d-4b85-b044-84649fe3a6d1

Costa AvosLocker May 2022

ATTACK:enterprise:S0108 → uses → ATTACK:enterprise:T1686

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--35edfce6-c395-4dcd-b5be-848860f68d23

TechNet Netsh · TechNet Netsh Firewall

ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--437dd20a-234f-430b-b9ee-4524e1e12aa9

Baumgartner Naikon 2015

ATTACK:enterprise:S0108 → uses → ATTACK:enterprise:T1546.007

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--581f8dd6-edd4-467b-a3d5-3177870b0264

Demaske Netsh Persistence

ATTACK:enterprise:S0108 → uses → ATTACK:enterprise:T1090

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--69c1806d-e6ae-4c11-bce6-8fbebd8bbee5

Securelist fileless attacks Feb 2017

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9c97e0aa-61fd-4f42-881f-763a1b03c16b

Cybereason Cobalt Kitty 2017

ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f5f1262-17a7-443e-a531-c9048a91ac8d

DFIR Report APT35 ProxyShell March 2022

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9f62c4e4-02d4-497b-8039-cc4e816386a5

Novetta Blockbuster Loaders

ATTACK:enterprise:C0051 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a04ade46-d560-4b75-a678-edd8eff51f52

Nearest Neighbor Volexity

ATTACK:enterprise:G0008 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2e2d332-f27b-46fb-b48f-4ee1872b321f

Group-IB Anunak

ATTACK:enterprise:S0108 → uses → ATTACK:enterprise:T1518.001

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0d218a3-9f7b-4f21-aa4a-34dc25f05b61

TechNet Netsh · TechNet Netsh Firewall

ATTACK:enterprise:G0035 → uses → ATTACK:enterprise:S0108

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fc6b1d58-05bf-41a0-a7fd-fcbbae894430

US-CERT TA18-074A

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.