This note documents detection patterns related to Port Forwarding within Windows environments.

Direct Indicators

Indirect Indicators

Common Tools

Relevant Artifacts

• Security log 4688 for process creation with full command line where available
• Sysmon 1, 3, 11, 12, 13 for process execution, network connections, file drop, and PortProxy registry changes
• Security 5156 for connection approval telemetry if Sysmon is unavailable
• PowerShell logs 4103 / 4104 for script-based forwarding, firewall changes, or custom socket relay logic
• System 7040 / 7045 and Security 4697 for service-backed forwarding or required service changes
• Registry:
  • HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov4\tcp
  • HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v4tov6\tcp
  • HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v6tov4\tcp
  • HKLM\SYSTEM\CurrentControlSet\Services\PortProxy\v6tov6\tcp
• Registry/service dependency:
  • HKLM\SYSTEM\CurrentControlSet\Services\iphlpsvc
• Firewall-related registry context:
  • HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy
• Native inspection commands:
  • netsh interface portproxy show all
  • sc qc iphlpsvc
  • netstat -ano
  • Get-NetTCPConnection
• Prefetch where applicable:
  • NETSH.EXE
  • SSH.EXE
  • PLINK.EXE
  • CHISEL.EXE
  • SOCAT.EXE
• Amcache/ShimCache for execution evidence and binary paths of forwarding tools
• MFT / USN Journal for dropped tunnel binaries, configs, scripts, or key material
• SRUM for post-forwarding network usage on workstations where available
• EDR process/socket lineage to prove same process handled both listen and relay phases
• Firewall logs, proxy logs, and network telemetry for confirming data passed through the pivot host
• Service configuration and persistence artifacts if the forwarder is wrapped as a service or scheduled task

MITRE ATT&CK References

• T1090 Proxy
• T1090.001 Internal Proxy
• T1090.002 External Proxy
• T1090.003 Multi-hop Proxy
• T1090.004 Domain Fronting / protocol-adjacent proxy behavior (contextual depending on tooling)
• T1572 Protocol Tunneling
• T1047 Windows Management Instrumentation (contextual if WMI used to deploy the forwarder)
• T1569.002 Service Execution (contextual if tunnel deployed as a service)

Decision Tree

1. Is the suspicious event present?
   • Look for 4688 / Sysmon 1 showing netsh interface portproxy, ssh -L/-R/-D, plink, chisel, ligolo, or other relay tooling.
   • Check for Sysmon 13 / 12 registry writes under PortProxy.
2. What host and process generated it?
   • Identify the exact host, user, integrity level, parent process, and full command line.
   • Determine whether the process is a built-in utility (netsh, ssh) or a dropped third-party binary.
3. Is there a listener?
   • Validate with Sysmon 3, EDR socket telemetry, netstat, or connection logs whether a local listener was established.
   • Record bind address, local port, and whether the listener is loopback-only or externally reachable.
4. Is there an outbound relay destination?
   • Confirm whether the same process or a tightly linked child process connected to another system.
   • Map destination IP, port, protocol, and timing relative to inbound activity.
5. Is this persistent or temporary?
   • For native Windows forwarding, inspect PortProxy registry keys and the state of IP Helper (iphlpsvc).
   • For third-party tools, check for services, scheduled tasks, Run keys, Startup folder, config files, or helper scripts.
6. Pivot:
   • Source host → process execution
     • Hunt for file drops, configs, SSH keys, helper scripts, and repeated tunnel invocations.
   • Network → internal access expansion
     • Identify which internal systems became reachable only after the forwarder was established.
   • Adjacent admin changes
     • Check for firewall rules, service installation, credential use, LocalAccountTokenFilterPolicy, ADMIN$ access, or remote exec nearby.
7. Confirm scope and intent
   • Was this developer/admin activity, enterprise remote support, or attacker pivot infrastructure?
   • Determine whether the host acted as a single-use tunnel endpoint or a durable pivot node.

Example Detection Templates

KQL

// Native and tool-based port forwarding command-line hunt
let terms = dynamic(["portproxy","ssh -L","ssh -R","ssh -D","plink","chisel","ligolo","socat","frp","rinetd","portfwd"]);
union isfuzzy=true SecurityEvent, Sysmon
| where EventID in (4688, 1)
| extend Image = coalesce(tostring(NewProcessName), tostring(Image), tostring(Process)),
         CommandLine = coalesce(tostring(CommandLine), tostring(ProcessCommandLine)),
         ParentImage = coalesce(tostring(ParentProcessName), tostring(ParentImage))
| where CommandLine has_any (terms) or Image has_any ("netsh.exe","ssh.exe","plink.exe","chisel.exe","ligolo.exe","socat.exe","frpc.exe","frps.exe")
| project TimeGenerated, Computer, User=coalesce(tostring(SubjectUserName), tostring(User), tostring(UserName)), Image, CommandLine, ParentImage, EventID
| order by TimeGenerated desc

// Native Windows PortProxy registry hunt
Sysmon
| where EventID in (12, 13)
| where TargetObject has @"\SYSTEM\CurrentControlSet\Services\PortProxy\"
| project TimeGenerated, Computer, User, EventID, TargetObject, Details, Image, ProcessGuid, ProcessId
| order by TimeGenerated desc

// Correlate forwarding process creation with later network activity from same host/process
let Forwarders = Sysmon
| where EventID == 1
| extend Image = tostring(Process), CommandLine = tostring(CommandLine), ProcessId = tostring(ProcessId)
| where CommandLine has_any ("portproxy","ssh -L","ssh -R","ssh -D","plink","chisel","ligolo","socat","frp","portfwd")
   or Image has_any ("netsh.exe","ssh.exe","plink.exe","chisel.exe","ligolo.exe","socat.exe","frpc.exe","frps.exe")
| project FwdTime=TimeGenerated, Computer, ProcessId, Image, CommandLine, ParentImage=tostring(ParentProcessName), User=tostring(User);
let Net = Sysmon
| where EventID == 3
| extend ProcessId = tostring(ProcessId)
| project NetTime=TimeGenerated, Computer, ProcessId, DestinationIp, DestinationPort, SourceIp, SourcePort, Protocol, Image=tostring(Image);
Forwarders
| join kind=leftouter (Net) on Computer, ProcessId
| where NetTime between (FwdTime .. FwdTime + 30m)
| project FwdTime, NetTime, Computer, User, Image, CommandLine, ParentImage, SourceIp, SourcePort, DestinationIp, DestinationPort, Protocol
| order by FwdTime desc

// Hunt for IP Helper service changes around PortProxy creation
let PortProxyChanges = Sysmon
| where EventID in (12, 13)
| where TargetObject has @"\SYSTEM\CurrentControlSet\Services\PortProxy\"
| project PPTime=TimeGenerated, Computer, User, TargetObject;
let ServiceChanges = union isfuzzy=true SystemEvent, SecurityEvent
| where EventID in (7040, 7045, 4697)
| project SvcTime=TimeGenerated, Computer, EventID, RenderedDescription=tostring(EventData);
PortProxyChanges
| join kind=leftouter (ServiceChanges) on Computer
| where SvcTime between (PPTime - 10m .. PPTime + 10m)
| project PPTime, SvcTime, Computer, User, TargetObject, EventID, RenderedDescription
| order by PPTime desc

EQL

/* Tooling or native commands commonly used for port forwarding */
process where
  process.command_line like "*portproxy*" or
  process.command_line like "*ssh -L*" or
  process.command_line like "*ssh -R*" or
  process.command_line like "*ssh -D*" or
  process.command_line like "*plink*" or
  process.command_line like "*chisel*" or
  process.command_line like "*ligolo*" or
  process.command_line like "*socat*" or
  process.command_line like "*frp*"

/* PortProxy registry creation following netsh command */
sequence by host.name with maxspan=5m
  [ process where process.command_line like "*netsh*portproxy*" ]
  [ registry where registry.path like "*\\SYSTEM\\CurrentControlSet\\Services\\PortProxy\\*" ]

/* Forwarding process followed by outbound network connections */
sequence by host.name, process.pid with maxspan=30m
  [ process where process.command_line like "*ssh -L*" or process.command_line like "*ssh -R*" or process.command_line like "*chisel*" or process.command_line like "*plink*" or process.command_line like "*ligolo*" ]
  [ network where true ]

Sigma

title: Suspicious Port Forwarding Activity
id: 9f7a2c44-6d1d-4b47-a0f3-port-forwarding
status: experimental
description: Detects native Windows PortProxy and common tool-based port forwarding commands frequently associated with pivoting or covert transport infrastructure.
references:
  - https://attack.mitre.org/techniques/T1090/
  - https://attack.mitre.org/techniques/T1572/
author: Vergil
date: 2026-03-07
logsource:
  product: windows
  category: process_creation
detection:
  selection_cmd:
    CommandLine|contains:
      - 'portproxy'
      - 'ssh -L'
      - 'ssh -R'
      - 'ssh -D'
      - 'plink'
      - 'chisel'
      - 'ligolo'
      - 'socat'
      - 'frp'
      - 'portfwd'
  selection_img:
    Image|endswith:
      - '\netsh.exe'
      - '\ssh.exe'
      - '\plink.exe'
      - '\chisel.exe'
      - '\ligolo.exe'
      - '\socat.exe'
      - '\frpc.exe'
      - '\frps.exe'
  condition: selection_cmd or selection_img
fields:
  - Image
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Legitimate administrator tunneling
  - Developer SSH tunnels
  - Approved remote support tooling
  - Network engineering diagnostics
level: high
tags:
  - attack.command_and_control
  - attack.t1090
  - attack.t1572

title: Native Windows PortProxy Registry Modification
id: 4c5fd447-e1fd-4ed9-b8f0-portproxy-registry
status: experimental
description: Detects registry modifications associated with native Windows netsh interface portproxy forwarding.
references:
  - https://attack.mitre.org/techniques/T1090/
author: Vergil
date: 2026-03-07
logsource:
  product: windows
  category: registry_set
detection:
  selection:
    TargetObject|contains: '\SYSTEM\CurrentControlSet\Services\PortProxy\'
  condition: selection
fields:
  - TargetObject
  - Details
  - Image
  - User
falsepositives:
  - Legitimate portproxy administration
level: high
tags:
  - attack.command_and_control
  - attack.t1090

Mitigation & Hardening