Reverse SSH tunnel with disabled host-key checking (GlassWorm Claude Code)
Detects behavioral indicators of an SSH or autossh reverse tunnel (-R) executed with no remote command (-N) and host-key checking disabled, combined with network connections to a known command and control IP address.
Microsoft Sentinel (KQL)
