Suspicious New Port Forwarding Rule Added Through Netsh.EXE (via process_creation)

title: Suspicious New Port Forwarding Rule Added Through Netsh.EXE (via process_creation)
id: 909ff76c-7496-5e95-8d7d-feec4ea7e517
status: stable
description: This rule detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule
references:
    - https://attack.mitre.org/techniques/T1090/
    - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
    - https://adepts.of0x.cc/netsh-portproxy-code/
    - https://www.dfirnotes.net/portproxy_detection/
author: Huntrule Team
date: 2026-04-23
tags:
    - attack.lateral-movement
    - attack.command-and-control
    - attack.t1090
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\netsh.exe'
        - OriginalFileName: 'netsh.exe'
    selection_cli_1:
        CommandLine|contains|all:
            - 'interface'
            - 'portproxy'
            - 'add'
            - 'v4tov4'
    selection_cli_2:
        CommandLine|contains|all:
            - 'i '
            - 'p '
            - 'a '
            - 'v '
    selection_cli_3:
        CommandLine|contains|all:
            - 'connectp'
            - 'listena'
            - 'c='
    condition: selection_img and 1 of selection_cli_*
falsepositives:
    - Unknown
level: medium