Expanded Network Tunneling, Proxying, and Reverse Shells
Identifies potential network tunneling, proxying, and reverse shell activities by correlating process creation with outbound public network connections. This rule looks for known tunneling and proxy tool filenames and specific command-line arguments indicative of such activities, then correlates these process events with successful or attempted outbound network connections to public IP addresses.
Microsoft Sentinel (KQL)
