TS Phish - Stager Dropping Reverse Proxy (T1090)
Detects the dropping of reverse proxy binaries (like Ngrok or Cloudflare tunnel daemons) by PowerShell, which could be used to expose internal Terminal Services to the internet. This activity is often associated with phishing campaigns targeting Terminal Servers.
Microsoft Sentinel (KQL)
