Windows netsh.EXE Adds Portproxy v4-to-v4 Forwarding Rule
Flags netsh.exe command lines that add portproxy v4-to-v4 forwarding rules on Windows.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel (SigmaHQ), DRL 1.1
- Published
- 2019-01-29
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies execution of netsh.exe commands used to add a new Windows port forwarding (portproxy) rule, specifically v4tov4. Attackers can use portproxy configuration to redirect traffic and bypass network access controls for pivoting or command-and-control pathways. The detection relies on Windows process creation telemetry, matching the netsh executable name and required command-line parameters such as interface, portproxy, add, v4tov4, and connection/listening fields.
Reporting behind it
- fireeye.comhttps://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
- adepts.of0x.cchttps://adepts.of0x.cc/netsh-portproxy-code/
- dfirnotes.nethttps://www.dfirnotes.net/portproxy_detection/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows netsh.EXE Adds Portproxy v4-to-v4 Forwarding Rule
id: 14735996-43f8-4c6d-b116-94e5ddd9d5c1
status: test
description: This rule identifies execution of netsh.exe commands used to add a new Windows port forwarding (portproxy) rule, specifically v4tov4. Attackers can use portproxy configuration to redirect traffic and bypass network access controls for pivoting or command-and-control pathways. The detection relies on Windows process creation telemetry, matching the netsh executable name and required command-line parameters such as interface, portproxy, add, v4tov4, and connection/listening fields.
references:
- https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
- https://adepts.of0x.cc/netsh-portproxy-code/
- https://www.dfirnotes.net/portproxy_detection/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml
author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel, Huntrule Team
date: 2019-01-29
modified: 2023-09-01
tags:
- attack.lateral-movement
- attack.command-and-control
- attack.t1090
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli_1:
CommandLine|contains|all:
- interface
- portproxy
- add
- v4tov4
selection_cli_2:
CommandLine|contains|all:
- "i "
- "p "
- "a "
- "v "
selection_cli_3:
CommandLine|contains|all:
- connectp
- listena
- c=
condition: selection_img and 1 of selection_cli_*
falsepositives:
- Legitimate administration activity
- WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723)
level: medium
license: DRL-1.1
related:
- id: 322ed9ec-fcab-4f67-9a34-e7c6aef43614
type: derived