SigmaHQ/rules/windows/builtin/win_netsh_port_fwd.yml

---
action: global
title: Netsh Port Forwarding
description: Detects netsh commands that configure a port forwarding
references:
    - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
date: 2019/01/29
tags:
    - attack.lateral_movement
status: experimental
author: Florian Roth
detection:
    condition: selection
falsepositives:
    - Legitimate administration
level: medium
---
logsource:
    product: windows
    service: sysmon
detection:
    selection:
        EventID: 1
        CommandLine: 
            - 'netsh interface portproxy add v4tov4 *'
---
logsource:
    product: windows
    service: security
    definition: 'Requirements: Audit Policy : Detailed Tracking > Audit Process creation, Group Policy : Administrative Templates\System\Audit Process Creation'
detection:
    selection:
        EventID: 4688
        ProcessCommandLine: 
            - 'netsh interface portproxy add v4tov4 *'