Skip to content
Threat Feed
Subscribe

Tag

Port-Forwarding

2 briefs RSS
medium advisory

Windows Port Forwarding Rule Addition via Registry Modification

An adversary may abuse port forwarding to bypass network segmentation restrictions by creating a new port forwarding rule through modification of the Windows registry.

Elastic Defend +3 port-forwarding registry-modification command-and-control defense-evasion windows
2r 3t
medium advisory

Windows Port Forwarding Rule Addition via Registry Modification

This alert detects the creation of a new port forwarding rule in the Windows Registry, a technique used by attackers to bypass network segmentation and establish internal proxies for command and control or lateral movement.

Windows port-forwarding registry-modification lateral-movement
2r 3t