SSH Remote Port Forwarding or Tunneling Detection

Ankit Mehta@Secvyn

•updated Jun 5, 2026•8•0•15

This rule detects SSH connections initiated by 'ssh.exe' that involve remote port forwarding ('-R' flag) or potential SSH tunneling (command line containing both '@' and ':'). This behavior can be indicative of adversaries establishing covert communication channels or maintaining persistence.