Windows Plink Remote Port Forwarding via -R Command Line
Alerts on Windows process command lines using Plink " -R " remote port forwarding to a local port.
- Product
- windows
- Category
- process_creation
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-01-19
- Updated
- 2026-07-30
ATT&CK techniques
Lateral Movement → C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process executions whose command line includes the port-forwarding pattern " -R " in Plink used as an SSH/Telnet/Rlogin client. Attackers commonly leverage port forwarding to bypass network restrictions and reach internal services through an existing connection. The detection relies on process creation telemetry and command-line content to identify the forwarded-port syntax.
Reporting behind it
- real-sec.comhttps://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/
- medium.comhttps://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_plink_port_forwarding.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Windows Plink Remote Port Forwarding via -R Command Line
id: 46d47b0f-bef9-4a07-b02c-4f75800901f0
status: test
description: This rule flags Windows process executions whose command line includes the port-forwarding pattern " -R " in Plink used as an SSH/Telnet/Rlogin client. Attackers commonly leverage port forwarding to bypass network restrictions and reach internal services through an existing connection. The detection relies on process creation telemetry and command-line content to identify the forwarded-port syntax.
references:
- https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/
- https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_plink_port_forwarding.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-19
modified: 2022-10-09
tags:
- attack.command-and-control
- attack.t1572
- attack.lateral-movement
- attack.t1021.001
logsource:
category: process_creation
product: windows
detection:
selection:
Description: Command-line SSH, Telnet, and Rlogin client
CommandLine|contains: " -R "
condition: selection
falsepositives:
- Administrative activity using a remote port forwarding to a local port
level: high
license: DRL-1.1
related:
- id: 48a61b29-389f-4032-b317-b30de6b95314
type: derived