Potential Persistence Via Netsh Helper DLL (56321594-9087-49d9-bf10-524fe8479452)
Detects the execution of netsh with "add helper" flag in order to add a custom helper DLL. This technique can be abused to add a malicious helper DLL that can be used as a persistence proxy that gets called when netsh.exe is executed.