TS Phish - Reverse Tunnel Logon Event

Ibrahim Saud@tektrix

•updated Jun 22, 2026•1•0•4

Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.