Skip to content
Threat Feed
Subscribe

Tag

Port-Forwarding

3 briefs RSS
medium advisory

Detection of Port Proxy Registry Modifications for Protocol Tunneling

Adversaries manipulate the Windows PortProxy registry keys to establish unauthorized port forwarding, enabling lateral movement and the bypassing of network segmentation.

command-and-control defense-evasion registry-modification windows port-forwarding
1r 3t
medium advisory

Windows Port Forwarding Rule Addition via Registry Modification

An adversary may abuse port forwarding to bypass network segmentation restrictions by creating a new port forwarding rule through modification of the Windows registry.

Elastic Defend +3 port-forwarding registry-modification command-and-control defense-evasion windows
2r 3t
medium advisory

Windows Port Forwarding Rule Addition via Registry Modification

This alert detects the creation of a new port forwarding rule in the Windows Registry, a technique used by attackers to bypass network segmentation and establish internal proxies for command and control or lateral movement.

Windows port-forwarding registry-modification lateral-movement
2r 3t