Windows PortProxy Registry Modification for Persistence

Attackers, notably those associated with the Volt Typhoon campaign, leverage the built-in Windows netsh utility to modify registry keys associated with the PortProxy feature. By altering keys within the HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4\tcp registry path, adversaries establish persistent network proxies. This technique allows attackers to forward traffic through compromised hosts, effectively bypassing network segmentation or security restrictions. By controlling these registry entries, the attacker can ensure that redirected traffic or helper DLLs are executed whenever the netsh service is invoked. Defenders should monitor registry modifications targeting these specific keys as a strong indicator of persistence and potential command-and-control infrastructure setup.

Attack Chain

1. Attacker gains initial access to a target Windows system through undisclosed methods.
2. Attacker performs internal reconnaissance to identify network configuration and potential proxy targets.
3. Attacker executes netsh.exe to configure port forwarding rules using the 'interface portproxy' command.
4. The netsh utility modifies registry keys under HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4\tcp to persist the configuration.
5. The system begins forwarding incoming traffic from the specified listening port to a remote destination controlled by the attacker.
6. Attacker utilizes the established proxy to tunnel Command-and-Control (C2) traffic or move laterally within the victim network.
7. Attacker maintains access by ensuring the registry-based configuration remains active through system reboots.

Impact

The abuse of the Windows PortProxy feature allows attackers to establish resilient backdoors into protected network environments. By turning compromised endpoints into relay nodes, attackers can mask their lateral movement, exfiltrate sensitive data, and evade perimeter-based network security controls. This technique has been specifically associated with the Volt Typhoon campaign targeting critical infrastructure.

Recommendation

1. Deploy the provided Sigma rule to monitor registry modifications within the PortProxy service path.
2. Implement registry monitoring (Sysmon Event ID 13) focusing on the HKLM\System\CurrentControlSet\Services\PortProxy registry hive.
3. Audit the current PortProxy configuration across the fleet using netsh interface portproxy show all to identify unauthorized redirection rules.
4. Restrict the ability of non-administrative users to execute netsh and modify system registry keys.