Windows netsh.exe Used to Create RDP (3389) Port Forwarding

Flags netsh.exe executions that appear to set up RDP (3389) port forwarding.

FreeUnreviewedSigmahighv1

windows-netsh-exe-used-to-create-rdp-3389-port-forwarding-782d6f3e

title: Windows netsh.exe Used to Create RDP (3389) Port Forwarding
id: 7011b316-2117-43e1-a536-f8784ca66d55
status: test
description: This rule identifies process creation where netsh.exe is executed with command-line arguments consistent with configuring a port forwarding involving port 3389 (RDP). Attackers may use port forwarding to bypass network restrictions and tunnel RDP traffic. The detection relies on Windows process creation telemetry, matching the netsh.exe image and specific command-line fragments for port and forwarding-related parameters.
references:
  - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml
author: Florian Roth (Nextron Systems), oscd.community, Huntrule Team
date: 2019-01-29
modified: 2023-02-13
tags:
  - attack.lateral-movement
  - attack.command-and-control
  - attack.t1090
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \netsh.exe
    - OriginalFileName: netsh.exe
  selection_cli:
    CommandLine|contains|all:
      - " i"
      - " p"
      - =3389
      - " c"
  condition: all of selection_*
falsepositives:
  - Legitimate administration activity
level: high
license: DRL-1.1
related:
  - id: 782d6f3e-4c5d-4b8c-92a3-1d05fed72e63
    type: derived

What it detects

This rule identifies process creation where netsh.exe is executed with command-line arguments consistent with configuring a port forwarding involving port 3389 (RDP). Attackers may use port forwarding to bypass network restrictions and tunnel RDP traffic. The detection relies on Windows process creation telemetry, matching the netsh.exe image and specific command-line fragments for port and forwarding-related parameters.

Known false positives

Legitimate administration activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.