huntrule

Windows RDP Tunneling Using plink.exe on Local Port 3389

Alert on plink.exe command lines referencing 127.0.0.1:3389 or port 3389, suggesting potential RDP tunneling on Windows.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-08-04
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process creation where plink.exe is invoked with command-line arguments indicating an RDP-related local port connection to 127.0.0.1:3389 or a generic 3389 usage. Attackers can use plink to create stealthy network tunneling paths that blend into legitimate tooling and bypass simpler egress or access controls. Telemetry required is Windows process creation events capturing the full image path and command line for plink.exe.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange
Suspicious SSH Reverse Tunnel Establishment (via process_creation)
Suspicious Cloudflared Tunnel Persistence Installed via msiexec (via process_creation)
Suspicious Renamed Tunneling Tool Executing from Windows Tasks Directory
Suspicious Reverse SSH Tunnel Creation with Host Key Verification Disabled (via process_creation)
Malicious Abyss Locker wmihelper SSH Backdoor Deployment (via file_event)
Malicious GS-Netcat Command and Control via Global Socket Relay Network (via dns_query)
Suspicious Microsoft Dev Tunnel Domain Resolution via DNS (via dns_query)
Suspicious DNS Query to Dynamic DNS and Tunneling Providers Abused by RATs
Suspicious SSH Reverse Tunnel Over DNS Port
Windows RDP Tunneling Using plink.exe on Local Port 3389
Pivot detection · T1572 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.