netsh.exe
Summary
Network Shell (netsh.exe) is a command-line utility for viewing and configuring network settings on Windows. It can manage firewall rules, network interfaces, IP addresses, wireless profiles, and many other network-related configurations. It supports a context-based command structure with helper DLLs.
netsh.exe is the 26th most commonly executed Windows program in EchoTrail's dataset, observed 2,157,937 times across enterprise environments. It typically runs from C:\Windows\System32 and it is most often launched by cmd.exe.
Behavior
Top Paths
- C:\Windows\System3296.63%
- C:\Windows\SysWOW643.37%
Top Hashes (SHA256)
- 6b691b06fa865f52c9484ef4f10e2e02ed6d7c3a3f474b8b138a33af7258b2a984.17%
- 41100c756bc97ffca70a69d18c4440d446bad9a876ff4f3d52210dd0bdaee0144.41%
- 71131c1535887fac329edca024dbed4c6a2bdc4f9e91ce2443ee3590165218362.25%
- 9efa9dafa09ae9ba6390a8f0f6751006c18a98b6692667ca08367cddb47ac6341.87%
- d70d165b6706c61c56f2ca91307f4bbdb9846acae1da3cfd84bf978ffb21af231.29%
- 0427f35170e8038e1dd7c913bfd7784ae539245c2faa0e1270056920fd41c22a1.12%
- 7482890b1875bdcec826f3385eac7dcdc38f17358a13b1b8c790bdb895ff50541.08%
- e5888e649c881e4bbbce472f6808f93b2b5564d3094995a5a08e66b2406c16070.96%
- 6b22dd9817e7fb63d45f675c08121d7051ed626efe65304603de8bf4b93b32cb0.7%
- 751525ff60a42609d4dfcbb9d70cec0c0650fc2b14b04994ede1b0159688278b0.51%
Process Ancestry
Top Grandparents
- LTSVC.exe80.24%
- PanGPS.exe3.76%
- services.exe0.7%
- PanGpHip.exe0.21%
- msiexec.exe0.15%
- explorer.exe0.14%
- LTClient.exe0.11%
- Uninstall.exe0.07%
- SUService.exe0.06%
- remsh.exe0.03%
Top Parents
- cmd.exe7.29%
- powershell.exe5.01%
- LTSVC.exe0.21%
- Dropbox.exe0.05%
- CcmExec.exe0.03%
Top Children
- conhost.exe100%
- netsh.exe<0.01%
- net1.exe<0.01%
Rare or environment-specific process names are omitted from ancestry tables. Percentages are of all observed relationships.
Security Analysis
What does netsh.exe normally do?
Located in C:\Windows\System32 or C:\Windows\SysWOW64. Commonly launched by application installers (SolsticeClient.exe accounts for the majority in this dataset), cmd.exe, powershell.exe, and VPN clients (FortiSSLVPNdaemon.exe). Spawns conhost.exe. Used for network diagnostics, firewall configuration, and interface management.
When is netsh.exe suspicious?
Firewall rule manipulation: netsh advfirewall firewall add/delete/set — especially disabling the firewall or adding allow rules for suspicious ports or programs. Port proxy/forwarding configuration: netsh interface portproxy. Wireless profile extraction: netsh wlan show profile key=clear. Loading helper DLLs: netsh add helper <malicious.dll>. Spawned by unusual parents like Office applications, w3wp.exe, or script interpreters.
How do attackers abuse netsh.exe?
Firewall manipulation: attackers disable Windows Firewall or add rules to allow C2 traffic (netsh advfirewall set allprofiles state off). Port forwarding: netsh interface portproxy creates port forwarding rules for lateral movement or C2 tunneling. Helper DLL persistence: netsh can load arbitrary DLLs via the helper DLL mechanism, providing persistence that survives reboots. WiFi credential theft: netsh wlan show profile key=clear dumps stored WiFi passwords in plaintext.
Detection guidance
High-confidence: netsh advfirewall set ... state off (disabling firewall). netsh add helper (DLL loading for persistence). netsh interface portproxy (port forwarding). netsh wlan show profile key=clear (credential theft). Medium-confidence: any netsh firewall rule modifications outside of known software installation windows. Correlate timing with software installation or configuration management activity.
False positive notes
Application installers frequently configure firewall rules via netsh during installation (SolsticeClient, VPN clients, conferencing software). FortiClient and other VPN products use netsh for network interface configuration. Management agents may query network configuration via netsh for health checks.
Related Processes
Ask Rocky about netsh.exe
Rocky answers questions about netsh.exe grounded in this same dataset — free, no account needed.
Need this data programmatically? The Rocky API includes 500 free lookups a month. Or just ask Rocky.
Data from EchoTrail's dataset of ~346M Windows process executions. Last extracted 2026-08-04.