Skip to content
Threat Feed
Subscribe
low advisory

Detection of SSH Reverse Port Forwarding on Windows

Adversaries are abusing native Windows OpenSSH and Plink binaries to establish unauthorized reverse SSH tunnels, bypassing inbound connectivity controls for C2 and lateral movement.

Adversaries frequently abuse native and dual-use tools like Windows OpenSSH (ssh.exe) and PuTTY’s Plink (plink.exe) to establish unauthorized network tunnels. By utilizing the reverse port forwarding capabilities inherent in the SSH protocol, attackers can expose internal services or establish dynamic SOCKS proxies that route traffic outbound to an attacker-controlled listener. This technique effectively bypasses restrictive inbound firewall rules and network access control lists (ACLs) by initiating the connection from within the compromised environment.

Defenders should monitor process creation events for these specific binaries when executed with arguments indicative of reverse forwarding, such as "-R" or "-oRemoteForward". This activity is commonly observed during the lateral movement and command-and-control phases of post-exploitation, as documented in reports detailing ransomware campaigns and domain compromise scenarios.

Impact

Successful implementation of reverse SSH tunnels allows attackers to maintain persistent access to an internal network, conduct lateral movement across subnets, and exfiltrate data while appearing as legitimate outbound traffic. This threat has been observed in campaigns leading to full domain compromise and ransomware deployment, posing a significant risk to enterprise infrastructure if left undetected.

Recommendation

  • Deploy the provided Sigma rule to identify unauthorized usage of OpenSSH and Plink with reverse forwarding arguments.
  • Implement process creation logging via Sysmon (Event ID 1) or equivalent EDR telemetry to capture full command-line arguments for these binaries.
  • Baseline legitimate administrative use of SSH/Plink within the environment; authorize specific service accounts or hosts that require these tools and alert on deviations.
  • Review network egress logs for connections to non-standard or untrusted remote SSH servers originating from endpoints that should not be hosting external tunnels.

Immediate actions

Deploy Sigma detection rule to SIEM.

Detection Engineering 48h

Threat Hunt

Search for historical process creation events for plink.exe or ssh.exe with -R arguments.

T1090.002 medium high confidence hunt now

Data: Process creation logs

Detection coverage 1

Detect Potential SSH Reverse Port Forwarding

low

Detects the use of Windows OpenSSH or Plink to create a reverse SSH port forward or reverse dynamic SOCKS proxy, which may indicate C2 or lateral movement.

sigma tactics: command_and_control techniques: T1021.004, T1090.002, T1572 sources: process_creation, windows

Detection queries are available on the platform. Get full rules →