Detection rules › Sigma
RDP tunneling configuration enabled for port forwarding
Detects scenarios where an attacker configure port forwarding on a host to redirect traffic to a C&C target.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Lateral Movement | T1021.001 Remote Services: Remote Desktop Protocol |
| Command & Control | T1572 Protocol Tunneling |
Event coverage
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Security-Auditing | Event ID 4688 | A new process has been created. |
Rule body yaml
title: RDP tunneling configuration enabled for port forwarding
description: Detects scenarios where an attacker configure port forwarding on a host to redirect traffic to a C&C target.
references:
- https://github.com/mdecrevoisier/EVTX-to-MITRE-Attack/tree/master/TA0011-Command%20and%20Control/T1090-Proxy
- https://www.mandiant.com/resources/bypassing-network-restrictions-through-rdp-tunneling
- https://embracethered.com/blog/posts/2020/windows-port-forward/
- https://davidhamann.de/2019/06/20/setting-up-portproxy-netsh/
- https://parsiya.net/blog/2016-06-07-windows-netsh-interface-portproxy/
- https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/
- https://media.defense.gov/2023/May/24/2003229517/-1/-1/0/CSA_Living_off_the_Land.PDF
- https://www.microsoft.com/en-us/security/blog/2023/05/24/volt-typhoon-targets-us-critical-infrastructure-with-living-off-the-land-techniques/
- https://practicalsecurityanalytics.com/how-to-leverage-internal-proxies-for-lateral-movement-firewall-evasion-and-trust-exploitation/
- https://www.volexity.com/blog/2024/11/22/the-nearest-neighbor-attack-how-a-russian-apt-weaponized-nearby-wi-fi-networks-for-covert-access/
tags:
- attack.command_and_control
- attack.t1572 # tunneling
- attack.lateral_movement
- attack.t1021.001 # remote services: RDP
author: mdecrevoisier
status: experimental
logsource:
product: windows
category: process_creation
detection:
selection_event:
NewProcessName|endswith: '\netsh.exe' # Full path "C:\Windows\system32\netsh.exe"
selection_command: # full command 'netsh interface portproxy add v4tov4 listenport=8001 listenaddress=0.0.0.0 connectport=3389 connectaddress=1.1.1.1'
Commandline|contains|all:
- interface
- portproxy
Commandline|contains:
- add # add forwarding
- reset # reset configuration
selection_obfuscated: # full command: 'netsh i p a v l=8001 listena=0.0.0.0 connectp=3389 c=1.1.1.1'
Commandline|contains|all:
- 'i ' # interface
- 'p ' # portproxy
Commandline|contains:
- 'a ' # add forwarding
- 'r ' # reset configuration
condition: selection_event and (selection_command or selection_obfuscated)
falsepositives:
- Administrator activity
level: high
Stages and Predicates
Stage 0: condition
selection_event and (selection_command or selection_obfuscated)Stage 1: selection_event
selection_event:
NewProcessName|endswith: '\netsh.exe'
Stage 2: selection_command
selection_command:
Commandline|contains|all:
- interface
- portproxy
Commandline|contains:
- add
- reset
Stage 3: selection_obfuscated
selection_obfuscated:
Commandline|contains|all:
- 'i '
- 'p '
Commandline|contains:
- 'a '
- 'r '
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
Commandline | match |
|
NewProcessName | ends_with |
|