Suspicious SSH Tunneling and Port Forwarding Activity

Muhammad Nameer@nameer

•updated Apr 30, 2026•30•1•587

Detects process executions containing SSH tunneling or port forwarding parameters correlated with outbound network connections to external public IPs. This may indicate protocol tunneling for evasion or data exfiltration.