Elastic medium stable eql

Port Forwarding Rule Addition

Identifies the creation of a new port forwarding rule. An adversary may abuse this technique to bypass network segmentation restrictions.

View Source

Detection Logic

registry where host.os.type == "windows" and event.type == "change" and 
  registry.path : "*\\SYSTEM\\*ControlSet*\\Services\\PortProxy\\v4tov4\\*" and registry.data.strings != null

Field Validations

Loading…

Comments (0)

Loading comments...