Windows Process Creation: SSH Port-Forwarding Commands Targeting RDP (3389)
Flags Windows command lines using SSH port-forwarding switches that also reference RDP port :3389.
- Product
- windows
- Category
- process_creation
- Author
- Tim Rauch, Elastic (idea) (SigmaHQ), DRL 1.1
- Published
- 2022-09-27
- Updated
- 2026-07-30
ATT&CK techniques
Lateral MovementRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags Windows process creation events where the command line includes the RDP port indicator ':3389' along with common SSH port-forwarding related switches. Attackers can use SSH tunnels to forward or route RDP traffic through intermediate hosts, helping them reach systems that would otherwise be unreachable. The detection relies on process command-line telemetry to identify these tunneling patterns.
Reporting behind it
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: SSH Port-Forwarding Commands Targeting RDP (3389)"
id: 63d71788-7a05-43e6-a156-ca26a71afc7c
status: test
description: This rule flags Windows process creation events where the command line includes the RDP port indicator ':3389' along with common SSH port-forwarding related switches. Attackers can use SSH tunnels to forward or route RDP traffic through intermediate hosts, helping them reach systems that would otherwise be unreachable. The detection relies on process command-line telemetry to identify these tunneling patterns.
references:
- https://www.elastic.co/guide/en/security/current/potential-remote-desktop-tunneling-detected.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_susp_remote_desktop_tunneling.yml
author: Tim Rauch, Elastic (idea), Huntrule Team
date: 2022-09-27
tags:
- attack.lateral-movement
- attack.t1021
logsource:
category: process_creation
product: windows
detection:
selection:
CommandLine|contains: :3389
selection_opt:
CommandLine|contains:
- " -L "
- " -P "
- " -R "
- " -pw "
- " -ssh "
condition: all of selection*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 8a3038e8-9c9d-46f8-b184-66234a160f6f
type: derived