huntrule

Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags

Alerts on renamed Plink executions using SSH port forwarding flags in Windows process creation logs.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-06
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags Windows process executions where the process has OriginalFileName set to Plink and the command line includes SSH port forwarding-related arguments (-l forward, -P, and -R). Renamed binaries can help attackers evade simple allow/block lists while using the same underlying tool functionality. Detection relies on process creation telemetry with OriginalFileName and full command-line content, and it excludes events where the image ends with the standard plink.exe path suffix.

Reporting behind it

Related detections9 linkedT1036 — drag to rearrange
Suspicious Rclone Exfiltration Masquerading as wininit.exe
Suspicious Executable Running from Public Pictures Directory
Suspicious Python Execution via Renamed Synaptics Binary
Agent Tesla Persistence via Realtek Named Scheduled Task Batch
Suspicious Interlock Fake Updater Executable Execution
Malicious User Account Created by a Computer Account (via security)
Suspicious Execution of agent.exe From WinSyncDefender AppData Directory (via process_creation)
Malicious Scheduled Task Masquerading as Auto Update via schtasks (via process_creation)
Suspicious Novaservice Binary Executing From Public User Directory (via process_creation)
Windows Process Creation: Renamed Plink (plink.exe) with SSH Port Forwarding Flags
Pivot detection · T1036 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.