Volt Typhoon netsh portproxy v4tov4 Port Forwarding (T1090.001, T1572)

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•1

Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.