Potential SSH Tunnel Persistence Install Using A Scheduled Task

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•6•0•23

Detects the creation of new scheduled tasks via commandline using `schtasks.exe` that specifically call `OpenSSH` components (`sshd.exe` or `ssh.exe`) with parameters indicative of establishing a reverse SSH tunnel. This activity suggests an adversary is attempting to establish persistence and command-and-control by creating a scheduled task to maintain a connection to their server.