New PortProxy Registry Entry Added

calendar Apr 28, 2026 · attack.lateral-movement attack.command-and-control attack.t1090  ·
Share on: linkedin copy

Detects the modification of the PortProxy registry key which is used for port forwarding.

Sigma rule (View on GitHub)

 1title: New PortProxy Registry Entry Added
 2id: a54f842a-3713-4b45-8c84-5f136fdebd3c
 3status: test
 4description: Detects the modification of the PortProxy registry key which is used for port forwarding.
 5references:
 6    - https://www.fireeye.com/blog/threat-research/2019/01/bypassing-network-restrictions-through-rdp-tunneling.html
 7    - https://adepts.of0x.cc/netsh-portproxy-code/
 8    - https://www.dfirnotes.net/portproxy_detection/
 9author: Andreas Hunkeler (@Karneades)
10date: 2021-06-22
11modified: 2024-03-25
12tags:
13    - attack.lateral-movement
14    - attack.command-and-control
15    - attack.t1090
16logsource:
17    category: registry_event
18    product: windows
19detection:
20    selection:
21        # Example: HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4\tcp\0.0.0.0/1337
22        TargetObject|contains: '\Services\PortProxy\v4tov4\tcp\'
23    condition: selection
24falsepositives:
25    - WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723)
26    - Synergy Software KVM (https://symless.com/synergy)
27level: medium

References

Related rules

to-top