How does Netsh persistence work using a helper DLL?

Netsh persistence involves writing a malicious DLL that exports the `InitHelperDll` function, then using the `netsh add helper` command (or directly adding a registry key under `HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\NetSh`) to register it. Every time netsh runs, it loads the helper DLL and calls `InitHelperDll`, which executes the attacker's payload. This technique is similar to other persistence methods like [Use CLR to maintain persistence](/news/use-clr-to-maintain-persistence) that leverage native system components.