Unusual Netsh PortProxy rule

Cortex XDR Analytics Alert Reference by Alert name

Product

Cortex XDR

Last date published

2024-10-08

Activation Period	14 Days
Training Period	30 Days
Test Period	N/A (single event)
Deduplication Period	1 Day
Required Data	Requires: XDR Agent with eXtended Threat Hunting (XTH)
Detection Modules
Detector Tags
ATT&CK Tactic	Defense Evasion (TA0005) Command and Control (TA0011)
ATT&CK Technique	Impair Defenses: Disable or Modify System Firewall (T1562.004) Proxy: Internal Proxy (T1090.001)
Severity	Low

Attackers may use Netsh PortProxy rules as part of malicious actions performed in an organizational network (e.g., for tunneling).

Adding or deleting netsh forwarding rules as a proxy and to avoid possible detection.

Check the connect address and if it's a known IP/domain.
Check whether the causality group owner (CGO) process is benign, and if this was a desired behavior as part of its normal execution flow.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

Attackers may use Netsh PortProxy rules as part of malicious actions performed in an organizational network (e.g., for tunneling).

Adding or deleting netsh forwarding rules as a proxy and to avoid possible detection.

Check the connect address and if it's a known IP/domain.
Check whether the causality group owner (CGO) process is benign, and if this was a desired behavior as part of its normal execution flow.

ATT&CK Tactic

ATT&CK Technique

Severity

Medium

Attackers may use Netsh PortProxy rules as part of malicious actions performed in an organizational network (e.g., for tunneling).

Adding or deleting netsh forwarding rules as a proxy and to avoid possible detection.

Check the connect address and if it's a known IP/domain.
Check whether the causality group owner (CGO) process is benign, and if this was a desired behavior as part of its normal execution flow.