Port forwarding flags on ssh, plink or netsh portproxy

Siemphony@siemphonylowT1572unverified

AN1483 describes plink.exe, ssh.exe or netsh.exe carrying an encapsulated protocol outbound, and this rule takes the process-creation leg of it: the argv that sets a tunnel up is the one part of the analytic a single event can hold. The SSH selection requires -L, -R or -D immediately followed by a port number rather than matching the bare flag with contains: Sigma matching is case-insensitive and this corpus renders every regex with (?i), so any form of the flag also fires on the very common 'ssh -l username', and it is the required digit — not the letter case — that separates a forward spec from a login name. The cost is that ES|QL will not render a regex at all; validate records that refusal and the other three backends carry the rule. The netsh selection requires connectaddress, which only the portproxy add form carries, so show and delete do not fire. The rule is written in the Sysmon EventID 1 vocabulary (Image, CommandLine) that the brief names; Sysmon is not present in a default install, and on an estate feeding process_creation from Security 4688 instead, CommandLine is empty unless Audit Process Creation and the separate Include command line in process creation events policy are both enabled. Two limits worth knowing: a forward written with a hostname bind address ('-L localhost:3389:...') has no digit after the flag and is missed, and the brief's other two log sources are not usable here — Sysmon EventID 3 names the process owning the socket, so a netsh portproxy forward is performed by the IP Helper service inside svchost.exe and an Image selector on netsh.exe there would never fire. UNVERIFIED — derived from MITRE ATT&CK DET0538 and never executed against logs.Full description

The 3 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where (((FolderPath endswith "\\ssh.exe" or FolderPath endswith "\\plink.exe") and ProcessCommandLine matches regex "(?i) -[LRD][ ]?[0-9]") or (FolderPath endswith "\\netsh.exe" and (ProcessCommandLine contains "portproxy" and ProcessCommandLine contains "connectaddress")))

Splunk · SPL

Run this as a search.

index=* | where (((match(Image, "(?i)\\\\ssh\\.exe$") OR match(Image, "(?i)\\\\plink\\.exe$")) AND match(CommandLine, " -[LRD][ ]?[0-9]")) OR (match(Image, "(?i)\\\\netsh\\.exe$") AND (match(CommandLine, "(?i)portproxy") AND match(CommandLine, "(?i)connectaddress"))))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\ssh\.exe$|\\plink\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i) -[LRD][ ]?[0-9]</field>    <description>Port forwarding flags on ssh, plink or netsh portproxy (1/2)</description>    <mitre>      <id>T1572</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\netsh\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:portproxy))(?=.*(?:connectaddress)).*</field>    <description>Port forwarding flags on ssh, plink or netsh portproxy (2/2)</description>    <mitre>      <id>T1572</id>    </mitre>  </rule></group>

Elastic · ES|QL

Run this as a search.

Elastic cannot express this construct. ES|QL RLIKE uses Lucene regexp syntax, which has no case-insensitive flag, and Sigma regexes are case-insensitive. Use |contains/|startswith/|endswith, or write the ES|QL by hand. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: process_creation / windows
Level: low
Category: covert_c2_channels
Sigma status: experimental
Backends: 3 of 4 rendered
Updated: 3 Sept 2026
Rule ID: 5ac12d13-ea6d-4845-b3bd-3e7bc4976ff8

ATT&CKT1572

T1572Protocol Tunneling

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessoncovert c2 channels

covert c2 channelsAI draft — unreviewed

01 · What this rule detects

The command line that sets a tunnel up on Windows: ssh.exe or plink.exe invoked with a port-forward flag, or netsh.exe adding a portproxy entry. AN1483 describes an encapsulated protocol travelling outbound; this rule takes only the process-creation leg of it, because the argv is the one part of that analytic a single event can hold. It detects the setup, not the traffic — a tunnel established before logging started, or by a tool the selections do not name, produces nothing.

02 · Telemetry you need

process_creation/windows, written in the Sysmon EventID 1 vocabulary (Image, CommandLine) that the brief names. Sysmon is not in a default install. On an estate feeding process_creation from Security 4688 instead, CommandLine is empty unless Audit Process Creation and the separate Include command line in process creation events policy are both enabled — and with an empty CommandLine every selection here is structurally dead while still validating clean.

03 · How the logic works

Two selections, OR-ed with 1 of selection_*. selection_ssh_forward pairs Image|endswith on \ssh.exe or \plink.exe with CommandLine|re: ' -[LRD][ ]?[0-9]'. The regex, rather than a bare contains on -L, is the load-bearing choice: Sigma matching is case-insensitive and this corpus renders every regex with (?i), so any case-insensitive match on the flag letter also fires on the extremely common ssh -l username. It is the required digit after the flag — not the letter case — that separates a forward specification from a login name. The optional space handles both -L8080: and -L 8080:. The cost is real: ES|QL will not render a regex at all, so that backend drops the rule; validate records the refusal and the other three backends carry it. selection_netsh_portproxy pairs Image|endswith: '\netsh.exe' with CommandLine|contains|all on both portproxy and connectaddress. Requiring connectaddress means only the add form matches; show and delete do not. Two of the brief's three log sources were left alone deliberately. Sysmon EventID 3 names the process that owns the socket, and a netsh portproxy forward is performed by the IP Helper service inside svchost.exe — an Image selector on netsh.exe there would never fire.

04 · Common false positives

Constantly, on any estate with engineers. ssh -L and plink -L through a bastion to a database, web console, or RDP host is routine daily work, and it is the highest-volume match this rule produces by a wide margin — which is why the level is low, not high. Backup, monitoring, and vendor remote-support agents re-invoke ssh.exe with -R or -L on every scheduled run. Docker Desktop, WSL, and some corporate VPN clients add netsh interface portproxy entries with connectaddress during installation. And ssh -D SOCKS proxying is often the documented method in a team's own runbook.

05 · Detection maturity

tier_1: Lowest tier. Machine-derived from DET0538 and never executed against a log line — including the regex, whose behaviour against real argv strings is assumed rather than observed. Run it read-only for a week and count the -L hits before deploying it anywhere it can page someone.

Tuning & false positivesexperimental · 4 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE names the AllowedTools knob — allowlist the tunnelling tools admins legitimately use — which here means filtering on parent process, invoking user, or destination rather than on Image, since the binaries themselves are the whole signal. Baseline your bastion hostnames out of CommandLine first; the residue is far more interesting. Note the known gap: a forward written with a hostname bind address, -L localhost:3389:..., has no digit after the flag and is missed. MITRE's DataAsymmetryThreshold and TimeWindow knobs both belong to the network-connection leg and cannot be expressed in a single-event rule.

Declared by the author

Administrators and developers tunnelling to a database, web console or RDP host through a bastion with ssh.exe -L or plink.exe -L — on an engineering estate this is routine daily activity and is the highest-volume match this rule produces by a wide margin, which is why the level is set where it is.
Backup, monitoring and vendor remote-support agents that open a scheduled SSH tunnel to a support endpoint, re-invoking ssh.exe with -R or -L on every run.
Docker Desktop, WSL and some corporate VPN clients, which add netsh interface portproxy entries with connectaddress during installation or network setup to bridge a listener into the host stack.
SOCKS proxying set up deliberately for testing or for reaching a lab network, where ssh -D is the documented method in the team's own runbook.

Noise checkdid not run

The Sigma source did not build into an evaluable rule, so the check did not run. this rule uses a regular expression, which is not evaluated here — an untrusted pattern can be made to run for a very long time

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verificationnone

Never run

The lab has not evaluated this composition. A run needs a dataset of its log type — a capture of the technique it claims, or the benign baseline — and not every rule has one. Some are also held back by the evaluator’s own safety limits.

Other compositions here have been run and some carry the badge — this one has not, so nothing about it has been shown either way. Read the rule and its noise check on their own terms; silence here is the absence of evidence, not evidence of a problem.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1572, evaluated against their process_creation events.

Share this rule

/u/siemphony/5ac12d13-ea6d-4845-b3bd-3e7bc4976ff8

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

Port forwarding flags on ssh, plink or netsh portproxy

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Wazuh · XML rule

Elastic · ES|QL

Community

Verdicts from engineers who deployed it