Netsh portproxy
netsh interface portproxy turns a compromised host into a relay: traffic arriving on a listening port is forwarded to an address the attacker could not…
What it detects
netsh interface portproxy turns a compromised host into a relay: traffic arriving on a listening port is forwarded to an address the attacker could not reach directly. It is a standard pivot step and it survives reboot, because the mapping is stored in the registry.
This rule also covers netsh's ABBREVIATION syntax, which is the reason a portproxy-by-substring rule can be walked straight past. netsh resolves any unambiguous prefix, so netsh interface portproxy add v4tov4 listenport=8001 listenaddress=1.2.3.4 \ connectport=3389 connectaddress=1.2.3.5 and netsh I p a v l=8001 listena=1.2.3.4 connectp=3389 c=1.2.3.5 configure the same tunnel, and the literal string "portproxy" appears only in the first. The parameter stems below are what the abbreviated form cannot drop.
MITRE ATT&CK mapping
- T1090.001Proxy: Internal Proxy· Command and Control
False positives and triage
Legitimate uses exist — developers forwarding a local port, and some remote-support tooling configures a proxy deliberately. Confirm who ran it, whether the listening port is reachable from outside the host, and whether the connect address is a host the source machine has no business talking to. netsh interface portproxy show all on the endpoint lists mappings still in place; a mapping nobody can account for is the finding, not the command itself.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/windows/netsh_portproxy.yaml, licensed under the Apache License 2.0.
id: windows.lateral_movement.netsh_portproxy
version: 1.0.0
status: stable
severity: high
confidence: 0.8
platforms: [windows]
mitre_techniques: [T1090.001]
description: |
`netsh interface portproxy` turns a compromised host into a relay: traffic
arriving on a listening port is forwarded to an address the attacker could not
reach directly. It is a standard pivot step and it survives reboot, because the
mapping is stored in the registry.
This rule also covers netsh's ABBREVIATION syntax, which is the reason a
portproxy-by-substring rule can be walked straight past. netsh resolves any
unambiguous prefix, so
netsh interface portproxy add v4tov4 listenport=8001 listenaddress=1.2.3.4 \
connectport=3389 connectaddress=1.2.3.5
and
netsh I p a v l=8001 listena=1.2.3.4 connectp=3389 c=1.2.3.5
configure the same tunnel, and the literal string "portproxy" appears only in
the first. The parameter stems below are what the abbreviated form cannot drop.
match:
event_category: process
process_name_contains_any:
- netsh
command_line_contains_any:
- portproxy
# Abbreviated forms. Each is meaningless outside a portproxy command, and
# netsh.exe is already required above, so they do not widen the rule beyond
# this feature.
- v4tov4
- v4tov6
- v6tov4
- v6tov6
- listena
- listenp
- connecta
- connectp
correlation_keys: [hostname]
false_positive_guidance: |
Legitimate uses exist — developers forwarding a local port, and some remote-support
tooling configures a proxy deliberately. Confirm who ran it, whether the listening
port is reachable from outside the host, and whether the connect address is a host
the source machine has no business talking to. `netsh interface portproxy show all`
on the endpoint lists mappings still in place; a mapping nobody can account for is
the finding, not the command itself.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.