huntrule

Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags

Alerts on renamed Plink executions using SSH port forwarding flags in Windows process creation logs.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-06
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process executions where the process has OriginalFileName set to Plink and the command line includes SSH port forwarding-related arguments (-l forward, -P, and -R). Renamed binaries can help attackers evade simple allow/block lists while using the same underlying tool functionality. Detection relies on process creation telemetry with OriginalFileName and full command-line content, and it excludes events where the image ends with the standard plink.exe path suffix.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange
Suspicious Billbug Loader Artifacts in Windows Temp Directory
Malicious Scheduled Task Masquerading as Windows Defender Sync via schtasks (via process_creation)
Malicious Startup Persistence via WindowsDefenderSync Shortcut (via file_event)
Malicious PXA Stealer Archive Extraction via Renamed WinRAR images.png (via process_creation)
Malicious NimDoor Loader Persistence via Masqueraded Google Updater (via file_event)
Suspicious Rename of Double-Extension PowerShell Script (via process_creation)
Suspicious Cobalt Strike OCSP Malleable C2 Profile Traffic
Suspicious Spoofed Microsoft Host Header C2 by Stately Taurus
Suspicious Double Extension Image Executable by Fighting Ursa
Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags
Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.