Reverse SSH tunnel using identity key shortly after key file written

ills3c Intel&Coffee@Ills3C

•updated 2 days ago•6•0•7

Detects the sequence where a private key file is written to the host followed by the execution of ssh.exe with parameters indicating a reverse port forwarding tunnel (-R), an identity file (-i), and background execution (-N or -f) within a 30-minute window.