Port Forwarding via SSH.EXE on Windows
Flags Windows executions of ssh.exe using remote port forwarding (-R) based on process creation command-line content.
- Product
- windows
- Category
- process_creation
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2022-10-12
- Updated
- 2026-07-30
ATT&CK techniques
Lateral Movement → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags process executions of ssh.exe where the command line includes a remote port forwarding argument (-R). Attackers can use SSH port forwarding to route traffic through an affected host for command-and-control or lateral movement. Telemetry relies on Windows process creation events, specifically the image path ending with \ssh.exe and matching command-line text containing ' -R '.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Port Forwarding via SSH.EXE on Windows
id: f549061c-82c1-43e7-a0ce-f36f8669aa5d
status: test
description: This rule flags process executions of ssh.exe where the command line includes a remote port forwarding argument (-R). Attackers can use SSH port forwarding to route traffic through an affected host for command-and-control or lateral movement. Telemetry relies on Windows process creation events, specifically the image path ending with \ssh.exe and matching command-line text containing ' -R '.
references:
- https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ssh_port_forward.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-12
modified: 2024-03-05
tags:
- attack.command-and-control
- attack.lateral-movement
- attack.t1572
- attack.t1021.001
- attack.t1021.004
logsource:
category: process_creation
product: windows
detection:
selection:
Image|endswith: \ssh.exe
CommandLine|contains|windash: " -R "
condition: selection
falsepositives:
- Administrative activity using a remote port forwarding to a local port
level: medium
license: DRL-1.1
related:
- id: 327f48c1-a6db-4eb8-875a-f6981f1b0183
type: derived