SSH Port Forwarding and Reverse Tunneling via ssh.exe or plink.exe
Detects the execution of SSH or Plink processes with command-line arguments indicating local, remote, or dynamic port forwarding. Adversaries may use port forwarding to tunnel traffic through a compromised host to bypass network segment restrictions or access internal resources.
SentinelOne
