Port Proxy Forwarding via Netsh and Registry Modification

Google SecOps@GoogleSecOps

•updated Jun 2, 2025•0•45

This rule detects the use of the `netsh interface portproxy` command to enable port forwarding, specifically looking for `v4tov4` configurations. It also identifies the creation or modification of associated registry settings under `HKLM\System\CurrentControlSet\Services\PortProxy\v4tov4`, which are indicative of port proxying being configured on a Windows system.