Windows netsh.exe Used to Create RDP (3389) Port Forwarding
Flags netsh.exe executions that appear to set up RDP (3389) port forwarding.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems), oscd.community (SigmaHQ), DRL 1.1
- Published
- 2019-01-29
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule identifies process creation where netsh.exe is executed with command-line arguments consistent with configuring a port forwarding involving port 3389 (RDP). Attackers may use port forwarding to bypass network restrictions and tunnel RDP traffic. The detection relies on Windows process creation telemetry, matching the netsh.exe image and specific command-line fragments for port and forwarding-related parameters.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows netsh.exe Used to Create RDP (3389) Port Forwarding
id: 7011b316-2117-43e1-a536-f8784ca66d55
status: test
description: This rule identifies process creation where netsh.exe is executed with command-line arguments consistent with configuring a port forwarding involving port 3389 (RDP). Attackers may use port forwarding to bypass network restrictions and tunnel RDP traffic. The detection relies on Windows process creation telemetry, matching the netsh.exe image and specific command-line fragments for port and forwarding-related parameters.
references:
- https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_netsh_port_forwarding_3389.yml
author: Florian Roth (Nextron Systems), oscd.community, Huntrule Team
date: 2019-01-29
modified: 2023-02-13
tags:
- attack.lateral-movement
- attack.command-and-control
- attack.t1090
logsource:
category: process_creation
product: windows
detection:
selection_img:
- Image|endswith: \netsh.exe
- OriginalFileName: netsh.exe
selection_cli:
CommandLine|contains|all:
- " i"
- " p"
- =3389
- " c"
condition: all of selection_*
falsepositives:
- Legitimate administration activity
level: high
license: DRL-1.1
related:
- id: 782d6f3e-4c5d-4b8c-92a3-1d05fed72e63
type: derived