Windows netsh.EXE Adds Portproxy v4-to-v4 Forwarding Rule

Flags netsh.exe command lines that add portproxy v4-to-v4 forwarding rules on Windows.

FreeUnreviewedSigmamediumv1

windows-netsh-exe-adds-portproxy-v4-to-v4-forwarding-rule-322ed9ec

title: Windows netsh.EXE Adds Portproxy v4-to-v4 Forwarding Rule
id: 14735996-43f8-4c6d-b116-94e5ddd9d5c1
status: test
description: This rule identifies execution of netsh.exe commands used to add a new Windows port forwarding (portproxy) rule, specifically v4tov4. Attackers can use portproxy configuration to redirect traffic and bypass network access controls for pivoting or command-and-control pathways. The detection relies on Windows process creation telemetry, matching the netsh executable name and required command-line parameters such as interface, portproxy, add, v4tov4, and connection/listening fields.
references:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
  - https://adepts.of0x.cc/netsh-portproxy-code/
  - https://www.dfirnotes.net/portproxy_detection/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding.yml
author: Florian Roth (Nextron Systems), omkar72, oscd.community, Swachchhanda Shrawan Poudel, Huntrule Team
date: 2019-01-29
modified: 2023-09-01
tags:
  - attack.lateral-movement
  - attack.command-and-control
  - attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli_1:
    CommandLine|contains|all:
      - interface
      - portproxy
      - add
      - v4tov4
  selection_cli_2:
    CommandLine|contains|all:
      - "i "
      - "p "
      - "a "
      - "v "
  selection_cli_3:
    CommandLine|contains|all:
      - connectp
      - listena
      - c=
  condition: selection_img and 1 of selection_cli_*
falsepositives:
  - Legitimate administration activity
  - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723)
level: medium
license: DRL-1.1
related:
  - id: 322ed9ec-fcab-4f67-9a34-e7c6aef43614
    type: derived

What it detects

This rule identifies execution of netsh.exe commands used to add a new Windows port forwarding (portproxy) rule, specifically v4tov4. Attackers can use portproxy configuration to redirect traffic and bypass network access controls for pivoting or command-and-control pathways. The detection relies on Windows process creation telemetry, matching the netsh executable name and required command-line parameters such as interface, portproxy, add, v4tov4, and connection/listening fields.

Known false positives

Legitimate administration activity
WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723)

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.