Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags

title: "Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags"
id: 933e8371-ab28-43e0-b512-2a0d3aef0991
status: test
description: This rule flags Windows process executions where the process has OriginalFileName set to Plink and the command line includes SSH port forwarding-related arguments (-l forward, -P, and -R). Renamed binaries can help attackers evade simple allow/block lists while using the same underlying tool functionality. Detection relies on process creation telemetry with OriginalFileName and full command-line content, and it excludes events where the image ends with the standard plink.exe path suffix.
references:
  - https://thedfirreport.com/2022/06/06/will-the-real-msiexec-please-stand-up-exploit-leads-to-data-exfiltration/
  - https://the.earth.li/~sgtatham/putty/0.58/htmldoc/Chapter7.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_renamed_plink.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-06
modified: 2023-02-03
tags:
  - attack.stealth
  - attack.t1036
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    - OriginalFileName: Plink
    - CommandLine|contains|all:
        - " -l forward"
        - " -P "
        - " -R "
  filter:
    Image|endswith: \plink.exe
  condition: selection and not filter
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 1c12727d-02bf-45ff-a9f3-d49806a3cf43
    type: derived