Port Forwarding Activity Via SSH.EXE

Title: Port Forwarding Activity Via SSH.EXE
Status: test
Description:Detects port forwarding activity via SSH.exe
References:
  -https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-12
modified:2024-03-05
Tags:

• -'attack.command-and-control'
• -'attack.lateral-movement'
• -'attack.t1572'
• -'attack.t1021.001'
• -'attack.t1021.004'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\ssh.exe'
    CommandLine|contains|windash: ' -R '
  condition:selection
Falsepositives:
  -Administrative activity using a remote port forwarding to a local port
Level: medium