RDP Over Reverse SSH Tunnel

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•0

Detects svchost hosting RDP termsvcs communicating with the loopback address and on TCP port 3389