SSH - Reverse/Dynamic Port Forwarding Tunnel

Georg Lauenstein@gsec

•updated 5 days ago•0•0•0

Detects SSH clients launched with reverse (-R) or dynamic (-D) port forwarding flags, a hallmark of tunnel establishment used to pivot into internal networks or expose internal services through a compromised host. The Blinder Tunnel campaign leverages SSH tunneling to encapsulate C2 and lateral movement traffic inside an allowed protocol.