Windows Plink Remote Port Forwarding via -R Command Line

title: Windows Plink Remote Port Forwarding via -R Command Line
id: 46d47b0f-bef9-4a07-b02c-4f75800901f0
status: test
description: This rule flags Windows process executions whose command line includes the port-forwarding pattern " -R " in Plink used as an SSH/Telnet/Rlogin client. Attackers commonly leverage port forwarding to bypass network restrictions and reach internal services through an existing connection. The detection relies on process creation telemetry and command-line content to identify the forwarded-port syntax.
references:
  - https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/
  - https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_plink_port_forwarding.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-01-19
modified: 2022-10-09
tags:
  - attack.command-and-control
  - attack.t1572
  - attack.lateral-movement
  - attack.t1021.001
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Description: Command-line SSH, Telnet, and Rlogin client
    CommandLine|contains: " -R "
  condition: selection
falsepositives:
  - Administrative activity using a remote port forwarding to a local port
level: high
license: DRL-1.1
related:
  - id: 48a61b29-389f-4032-b317-b30de6b95314
    type: derived