After compromising a host, an attacker may attempt to create a reverse shell or tunnel traffic through the system. These techniques can provide interactive access, expose internal services, or help bypass network restrictions.
The source defines a cross-platform hunt focused on commonly used tunneling and remote administration utilities.
Tools Included in the Detection
The Windows process component includes:
ssh.exe;plink.exe;socat.exe;nc.exe;ncat.exe;chisel.exe;cloudflared.exe.
The query also searches for command-line arguments such as -R, -L, reverse, or tunnel.
Linux audit telemetry is searched for the same general toolset.
Detection Query
(data.win.system.eventID:1 and data.win.eventdata.image:(*\ssh.exe or *\plink.exe or *\socat.exe or *\nc.exe or *\ncat.exe or *\chisel.exe or *\cloudflared.exe) and data.win.eventdata.commandLine:(*-R* or *-L* or *reverse* or *tunnel*)) or (rule.groups: audit and data.audit.command:(ssh or socat or nc or ncat or chisel or cloudflared))
The source recorded 11 matching events during the previous 30 days.
Interpreting the Results
Some of these tools are legitimate. SSH port forwarding, for example, may be used by administrators and developers. Cloudflared may be part of an approved application architecture.
The important question is whether the tool is expected on the host and whether the command line matches an approved use case.
Unexpected use on a production server or newly compromised endpoint should receive more attention.
Investigation Priorities
Review:
command-line arguments;
destination hostname or IP;
local and remote ports;
user account;
parent process;
file path and signer;
first-seen timestamp;
other activity from the same host.
A tunnel launched by a web-server process or immediately after suspicious RCE activity is especially important.
Tuning Strategy
Create explicit baselines for approved SSH forwarding, remote support tools, and known Cloudflared deployments.
Exceptions should be scoped to:
known host;
approved account;
expected destination;
expected binary path;
expected command-line structure.
This keeps the rule useful for unexpected uses elsewhere.
Correlation with Other Activity
A reverse shell often appears alongside reconnaissance, credential access, or persistence. Correlating these events can increase confidence.
For example:
web application → shell → chisel tunnel → credential dumping
provides a much clearer attack pattern than any event alone.
Operational Value
The source produced only 11 matches, making this a relatively focused hunt.
Monitoring common tunneling tools can help defenders identify external administration channels that appear after exploitation and provide valuable visibility into command-and-control behavior.
