Xhunt Plink SSH Tunneling

Tim Peck@timpeck

•updated Nov 10, 2025•8•0•135

Detects the use of PuTTY Link (plink.exe) with command-line arguments indicative of SSH tunneling, executed from a suspicious file path. This technique is used by the xHunt APT group for lateral movement and to create covert communication channels.