How do you detect netsh portproxy and plink port forwarding?

Detect Windows port forwarding at two points. For netsh, alert on netsh interface portproxy add commands and on writes to the Services\PortProxy\v4tov4\tcp registry key, because the key can be edited without netsh; correlate with advfirewall rule changes opening the listen port and with a listener owned by svchost. For plink, alert on -L, -R or -D flags and on the outbound connection from the same process. During response, run netsh interface portproxy show all and compare against expected rules per host role.

Detecting Windows Port Forwarding: netsh portproxy and plink

The netsh interface portproxy feature lets Windows listen on one address and port and relay to another. It is built in, survives reboots through a registry key, and is a quiet way to reach an internal service from a compromised host. plink.exe, the PuTTY command-line client, offers the same capability over SSH. Both leave clear host artifacts.

Signals at a Glance

Signal	Where	ATT&CK
netsh interface portproxy add v4tov4 (or v4tov6, v6tov4)	Sysmon 1, 4688, EDR	T1090.001
Value written under Services\PortProxy\v4tov4\tcp	Sysmon 13, registry auditing	T1112
netsh advfirewall rule opened for the new listen port	Sysmon 1, firewall log 4946/4948	T1562.004
plink.exe with -L, -R or -D forwarding arguments	Sysmon 1, 4688, EDR	T1572
Listener on the portproxy port owned by svchost (iphlpsvc)	EDR listening telemetry	T1090.001

netsh portproxy Rules

The portproxy rule is stored under the PortProxy registry key and is run by the IP Helper service. That gives two independent detection points: the command that creates the rule and the registry write that persists it. Alert on both because the registry can be changed without netsh:

title: Windows PortProxy Rule Creation
logsource:
  category: process_creation
  product: windows
detection:
  selection_cmd:
    Image|endswith: '\netsh.exe'
    CommandLine|contains|all:
      - 'interface'
      - 'portproxy'
      - 'add'
  condition: selection_cmd
level: high
---
title: PortProxy Registry Value Set
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: '\Services\PortProxy\v4tov4\tcp'
  condition: selection
level: high
# tune/validate: some VPN and lab software uses portproxy; allow-list by
# host and account after review.

plink Forwards and Follow-Up

A plink forward needs credentials or a key, and the command line is usually explicit. The quickest net is process creation with forwarding flags plus an outbound connection from the same process to an external host. Review existing rules at scale with a sweep of the registry and netsh output:

// Microsoft Defender XDR (KQL) - portproxy / plink forwarding
DeviceProcessEvents
| where Timestamp > ago(30d)
| where (FileName =~ "netsh.exe" and ProcessCommandLine has_all ("portproxy", "add"))
     or (FileName =~ "plink.exe" and ProcessCommandLine has_any (" -L ", " -R ", " -D "))
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName
// Audit on endpoints: netsh interface portproxy show all
// tune/validate: record the expected rules per host role and diff against them.

Pair the netsh event with a firewall rule creation for the same port within minutes; the pair is rarely accidental.
Alert on a listener on a non-standard port owned by svchost.exe hosting the IP Helper service.
Collect netsh interface portproxy show all during incident response and compare it with the expected inventory.
Restrict the ability to modify the PortProxy key and the IP Helper service on servers.

Vetted sources

Use SigmaHQ rules for netsh portproxy and plink execution, Elastic rules for netsh port forwarding, Splunk ESCU analytics for portproxy changes and Microsoft documentation for the PortProxy key. Always baseline your own environment — some remote-access and lab products use portproxy legitimately.

Build Detections That Fire

Mjolnir Security helps blue teams turn threat intelligence into high-fidelity detections across endpoint, network, identity and cloud telemetry.

Detection EngineeringManaged Detection & ResponseThreat HuntingIncident ResponsePurple Teaming

Detection Engineering We build and tune detections mapped to ATT&CK from your own telemetry.
Threat Hunting as a Service Hypothesis-driven hunts for the behaviours on this page.
24/7 Incident Response Containment when a detection fires. Call +1 833 403 5875.

Written by: Mjolnir Threat Research (MTAC)  |  Published: October 12, 2026  |  Last reviewed: October 12, 2026

Signals at a Glance

netsh portproxy Rules

plink Forwards and Follow-Up

Build Detections That Fire

Protocol Tunneling Detection

Detection Hub

Reverse SSH Detection

SOCKS Proxy Detection