Potential RDP Tunneling Via SSH — Detection Rule

Execution of ssh.exe to perform data exfiltration and tunneling through RDP

Read the full analysis on IntelFusions