security-tools/blue-team-tools
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Rename Plink Port Forward Rule

Browse Source
This commit is contained in:
nasreddine.bencherchali@nextron-systems.com
2022-10-12 11:24:28 +02:00
parent f55f4ca2d6
commit faad0209de
1 changed files with 2 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
rules/windows/process_creation/proc_creation_win_susp_plink_remote_forward.yml → rules/windows/process_creation/proc_creation_win_susp_plink_port_forward.yml
+2 -2
View File
@@ -1,7 +1,7 @@
title: Suspicious Plink Remote Forwarding
title: Suspicious Plink Port Forwarding
id: 48a61b29-389f-4032-b317-b30de6b95314
status: test
description: Detects suspicious Plink tunnel remote forarding to a local port
description: Detects suspicious Plink tunnel port forwarding to a local port
references:
- https://www.real-sec.com/2019/04/bypassing-network-restrictions-through-rdp-tunneling/
- https://medium.com/@informationsecurity/remote-ssh-tunneling-with-plink-exe-7831072b3d7d