Suspicious New PortProxy Registry Entry Added (via registry_event)

title: Suspicious New PortProxy Registry Entry Added (via registry_event)
id: 6ee28411-6f1e-5afd-aae6-8de0cf82e309
status: stable
description: This rule detects the modification of the PortProxy registry key which is used for port forwarding.
references:
    - https://attack.mitre.org/techniques/T1090/
    - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
    - https://adepts.of0x.cc/netsh-portproxy-code/
    - https://www.dfirnotes.net/portproxy_detection/
author: Huntrule Team
date: 2026-03-14
tags:
    - attack.lateral-movement
    - attack.command-and-control
    - attack.t1090
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains: '\Services\PortProxy\v4tov4\tcp\'
    condition: selection
falsepositives:
    - Unknown
level: medium