Port Forwarding Activity Via SSH.EXE

SigmaHQ Detections@sigmaHQ

•updated Aug 28, 2025•2•0•34

This rule detects the creation of a process using 'ssh.exe' with command-line arguments indicative of remote port forwarding. Specifically, it looks for the '-R' flag, which is used to specify remote port forwarding in SSH. This activity can be used by adversaries for command and control or lateral movement by tunneling network communications.