Cortex XDR
#Scenario
Expose hidden internal pivot points by detecting where adversaries have manipulated the native Windows network routing configuration (portproxy) to forward malicious traffic through a compromised host.
markdown
> Make sure you're comfortable with the results in your own environment before using this more widely.
# Snippet - Netsh portproxy pivot listener.
## Scenario:
Imagine an environment in which a compromised edge or jump host is being used as a TCP relay so the operator's true source address is hidden behind a victim IP. The hallmark is a `netsh interface portproxy add v4tov4` listener.
## Logic:
Matches the exact `add v4tov4` form. The `connectaddress=` value in
the command line tells you where the relay points; investigate any value
outside your management ranges.
- [https://attack.mitre.org/techniques/T1090/001/](https://attack.mitre.org/techniques/T1090/001/)
- [https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a](ttps://www.cisa.gov/news-events/cybersecurity-advisories/aa24-038a)xql
// Make sure you're comfortable with the results in your own environment before using this more widely.
dataset = xdr_data
| filter event_type = ENUM.PROCESS and event_sub_type = ENUM.PROCESS_START
| filter lowercase(action_process_image_name) = "netsh.exe"
| filter lowercase(action_process_image_command_line) contains "portproxy"
and lowercase(action_process_image_command_line) contains "add"
and lowercase(action_process_image_command_line) contains "v4tov4"
| fields _time, agent_hostname, actor_effective_username,
causality_actor_process_image_name, action_process_image_command_line
| limit 100