Akira - Reverse SSH Tunnel for RDP Lateral Movement via ssh.exe
Detects execution of the SSH binary with command-line arguments indicative of port forwarding, specifically remote port forwarding (-R) or use of specific ports and IP addresses often associated with unauthorized proxying or command and control tunnels.
Splunk (SPL)
