New Port Forwarding Rule Added Via Netsh.EXE
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
Sigma
Detects the execution of netsh commands that configure a new port forwarding (PortProxy) rule. This can be used by adversaries for lateral movement, defense evasion, or command and control.
Already have an account?