RDP over Reverse SSH Tunnel WFP — Detection Rule

Detects svchost hosting RDP termsvcs communicating with the loopback address

Read the full analysis on IntelFusions