Skip to content
Threat Feed

Product

Sysmon Registry Events

1 brief RSS
medium advisory

Windows Port Forwarding Rule Addition via Registry Modification

An adversary may abuse port forwarding to bypass network segmentation restrictions by creating a new port forwarding rule through modification of the Windows registry.

Elastic Defend +3 port-forwarding registry-modification command-and-control defense-evasion windows
2r 3t