huntrule

Windows netsh.exe Used to Create RDP (3389) Port Forwarding

Flags netsh.exe executions that appear to set up RDP (3389) port forwarding.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems), oscd.community (SigmaHQ), DRL 1.1
Published
2019-01-29
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies process creation where netsh.exe is executed with command-line arguments consistent with configuring a port forwarding involving port 3389 (RDP). Attackers may use port forwarding to bypass network restrictions and tunnel RDP traffic. The detection relies on Windows process creation telemetry, matching the netsh.exe image and specific command-line fragments for port and forwarding-related parameters.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange
Malicious QDoor Remote Proxy Execution via WMIC Node Process Call Create of svhost from Temp (via process_creation)
Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key
Malicious Java Backdoor Execution from Public Documents via javaw (via process_creation)
Suspicious Proxyware Installation via accept-tos Flag on Linux
Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs
Malicious GenAI Browser Extension C2 and PAC Redirection (via proxy)
Malicious FRP Reverse Proxy Tunnel Identified by Hardcoded Token (via process_creation)
Suspicious SSH Reverse Tunnel Over DNS Port
Suspicious Chisel SOCKS Tunnel Command Line
Windows netsh.exe Used to Create RDP (3389) Port Forwarding
Pivot detection · T1090 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.