huntrule

Windows PortProxy Registry Key Modified for Port Forwarding

Alerts when PortProxy port-forwarding registry entries under the Windows TCP v4tov4 path are added or modified.

FreeReviewedSigma · Medium · v1
Product
windows
Category
registry_event
Author
Andreas Hunkeler (@Karneades) (SigmaHQ), DRL 1.1
Published
2021-06-22
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects changes to the Windows Registry path used by the PortProxy service for IPv4-to-IPv4 TCP port forwarding configuration. Attackers can abuse PortProxy to create or alter local-to-remote forwarding paths, enabling stealthy redirection of network traffic for lateral movement or command and control. It relies on Windows registry event telemetry that captures modifications to the target PortProxy key path.

Reporting behind it

Related detections9 linkedT1090 — drag to rearrange
Malicious QDoor Remote Proxy Execution via WMIC Node Process Call Create of svhost from Temp (via process_creation)
Suspicious SOCKS Proxy Persistence via SystemBC PowerShell Run Key
Malicious Java Backdoor Execution from Public Documents via javaw (via process_creation)
Suspicious Proxyware Installation via accept-tos Flag on Linux
Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs
Malicious GenAI Browser Extension C2 and PAC Redirection (via proxy)
Malicious FRP Reverse Proxy Tunnel Identified by Hardcoded Token (via process_creation)
Suspicious SSH Reverse Tunnel Over DNS Port
Suspicious Chisel SOCKS Tunnel Command Line
Windows PortProxy Registry Key Modified for Port Forwarding
Pivot detection · T1090 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.