Reverse SSH Tunnel Creation
Detects the execution of ssh.exe with the '-R' flag, indicating the creation of a reverse SSH tunnel (remote port forwarding). This technique is used to bypass inbound firewall rules and maintain encrypted access to internal endpoints, bypassing traditional C2.
Microsoft Sentinel (KQL)
