Potential RDP Tunneling Via SSH

Title: Potential RDP Tunneling Via SSH
Status: test
Description:Execution of ssh.exe to perform data exfiltration and tunneling through RDP
References:
  -https://www.absolomb.com/2018-01-26-Windows-Privilege-Escalation-Guide/
Author: Nasreddine Bencherchali (Nextron Systems)
Date: 2022-10-12
modified:2023-01-25
Tags:

• -'attack.command-and-control'
• -'attack.t1572'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\ssh.exe'
    CommandLine|contains: ':3389'
  condition:selection
Falsepositives:
  -Unknown
Level: high