Detectionmediumtest

New PortProxy Registry Entry Added

Detects the modification of the PortProxy registry key which is used for port forwarding.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Andreas HunkelerCreated Tue Jun 22Updated Mon Mar 25a54f842a-3713-4b45-8c84-5f136fdebd3cwindows

Log Source

WindowsRegistry Event

ProductWindows← raw: windows

CategoryRegistry Event← raw: registry_event

Events for Windows Registry modifications including key creation, modification, and deletion.

Detection Logic

detection:
    selection:
        # Example: HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4\tcp\0.0.0.0/1337
        TargetObject|contains: '\Services\PortProxy\v4tov4\tcp\'
    condition: selection

False Positives

WSL2 network bridge PowerShell script used for WSL/Kubernetes/Docker (e.g. https://github.com/microsoft/WSL/issues/4150#issuecomment-504209723)

Synergy Software KVM (https://symless.com/synergy)

References

MITRE ATT&CK

Tactics

TA0008 · Lateral Movement TA0005 · Defense Evasion TA0011 · Command and Control

Techniques

T1090 · Proxy

Rule Metadata

Rule ID

a54f842a-3713-4b45-8c84-5f136fdebd3c

Status

test

Level

medium

Type

Detection

Created

Tue Jun 22

Modified

Mon Mar 25

Author

Andreas Hunkeler

Path

rules/windows/registry/registry_event/registry_event_portproxy_registry_key.yml

Raw Tags

attack.lateral-movementattack.defense-evasionattack.command-and-controlattack.t1090

View on GitHub