RDP tunneling configuration enabled for port forwarding

Detects scenarios where an attacker configure port forwarding on a host to redirect traffic to a C&C target.