huntrule

Windows: ssh.exe RDP tunneling to :3389 via SSH

Alerts on Windows process executions of ssh.exe that reference RDP port :3389 for SSH tunneling.

FreeReviewedSigma · High · v1
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-10-12
Updated
2026-07-30
AnalysisDetection

ATT&CK techniques

C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule flags process executions where ssh.exe is launched and the command line includes ':3389', which is commonly used for RDP port targeting. Attackers may use SSH tunneling to route RDP-related traffic through an approved or less-monitored channel, helping evade network controls. The detection relies on Windows process creation telemetry, specifically the image path ending with '\ssh.exe' and the presence of ':3389' in the command line.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange
Suspicious SCATTERED SPIDER Chisel Tunnel to Cloudflare Quick Tunnel (via process_creation)
Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware
Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)
Possible Plink Reverse Tunnel Command Line Execution
Chisel Reverse Tunnel Tool Execution from Temporary Directory
Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)
Obfuscated RDP Tunneling Configuration Enabled for Port Forwarding (via process_creation)
Malicious RDP Tunneling (via rdp)
Suspicious SSH Reverse Tunnel via Renamed plink Utility on Triofox Host
Windows: ssh.exe RDP tunneling to :3389 via SSH
Pivot detection · T1572 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.