Suspicious Plink Port Forwarding

Title: Suspicious Plink Port Forwarding
Status: test
Description:Detects suspicious Plink tunnel port forwarding to a local port
References:
  -https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/
  -https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d
Author: Florian Roth (Nextron Systems)
Date: 2021-01-19
modified:2022-10-09
Tags:

• -'attack.command-and-control'
• -'attack.t1572'
• -'attack.lateral-movement'
• -'attack.t1021.001'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Description: 'Command-line SSH, Telnet, and Rlogin client'
    CommandLine|contains: ' -R '
  condition:selection
Falsepositives:
  -Administrative activity using a remote port forwarding to a local port
Level: high