RDP Over Reverse SSH Tunnel

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•33

Detects svchost.exe initiating an outbound network connection on TCP port 3389 (RDP) to a loopback address (127.0.0.0/8 or ::1/128). This behavior is indicative of RDP traffic being tunneled, potentially via a reverse SSH tunnel, to bypass network restrictions or for covert remote access.