Volt Typhoon Netsh PortProxy Tunneling

Bryant Smith@flowstate

•updated Mar 13, 2026•2•0•59

Detects living-off-the-land (LotL) activity associated with Volt Typhoon, specifically the use of 'netsh.exe' to configure port forwarding (portproxy), which is used for lateral movement and C2 tunneling.