Windows: ssh.exe RDP tunneling to :3389 via SSH

ATT&CK techniques

C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
- T1572Protocol Tunneling
Exfiltration
Impact

What it detects

This rule flags process executions where ssh.exe is launched and the command line includes ':3389', which is commonly used for RDP port targeting. Attackers may use SSH tunneling to route RDP-related traffic through an approved or less-monitored channel, helping evade network controls. The detection relies on Windows process creation telemetry, specifically the image path ending with '\ssh.exe' and the presence of ':3389' in the command line.

Reporting behind it

Related detections9 linkedT1572 — drag to rearrange

Suspicious SCATTERED SPIDER Chisel Tunnel to Cloudflare Quick Tunnel (via process_creation)

Suspicious Cloudflared Tunnel Execution for Command and Control by Kraken Ransomware

Suspicious OpenSSH Reverse Tunnel Over HTTPS Port (Chaos Ransomware)

Possible Plink Reverse Tunnel Command Line Execution

Chisel Reverse Tunnel Tool Execution from Temporary Directory

Malicious Anubis Ransomware Cloudflare Tunnel via cloudflared (via process_creation)

Obfuscated RDP Tunneling Configuration Enabled for Port Forwarding (via process_creation)

Malicious RDP Tunneling (via rdp)

Suspicious SSH Reverse Tunnel via Renamed plink Utility on Triofox Host

Windows: ssh.exe RDP tunneling to :3389 via SSH

Pivot detection · T1572 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-ssh-exe-rdp-tunneling-to-3389-via-ssh-f7d7ebd5

title: "Windows: ssh.exe RDP tunneling to :3389 via SSH"
id: a9bfbc5f-f609-4ab9-8354-a9abbe1cec74
related:
  - id: f38ce0b9-5e97-4b47-a211-7dc8d8b871da
    type: similar
  - id: f7d7ebd5-a016-46e2-9c54-f9932f2d386d
    type: derived
status: test
description: This rule flags process executions where ssh.exe is launched and the command line includes ':3389', which is commonly used for RDP port targeting. Attackers may use SSH tunneling to route RDP-related traffic through an approved or less-monitored channel, helping evade network controls. The detection relies on Windows process creation telemetry, specifically the image path ending with '\ssh.exe' and the presence of ':3389' in the command line.
references:
  - https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_ssh_rdp_tunneling.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-10-12
modified: 2023-01-25
tags:
  - attack.command-and-control
  - attack.t1572
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    Image|endswith: \ssh.exe
    CommandLine|contains: :3389
  condition: selection
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL