Reverse_ssh client execution with outbound reverse-tunnel connection

Ethan Andrews@eandrews

•updated Aug 13, 2026•4•0•13

Detects execution of a process matching the reverse_ssh client naming pattern followed by an outbound network connection, consistent with the open-source reverse_ssh tool establishing an outbound reverse SSH tunnel for C2/remote access.