Rule Info
Name
Network Interface Disabled Via Netsh
Author
Swachchhanda Shrawan Poudel (Nextron Systems)
Description
Detects netsh being used to disable a network interface.
Threat actors abuse this to cut off network connectivity and prevent remote recovery or intervention during destructive attacks.
Date
2026-05-04 00:00:00
Modified
None
Id
e6f7a8b9-c0d1-2e3f-4a5b-6c7d8e9f0a1b
Tags
attack.defense-impairment attack.t1685
Type
Nextron Sigma feed only (private)
Rule History
Scan your endpoints, forensic images or collected files with our portable scanner THOR