Renamed Plink Execution for SSH Tunneling
Detects the execution of a renamed Plink binary, which is often used by adversaries for SSH tunneling and data exfiltration. The rule specifically looks for the original filename 'Plink' combined with command-line arguments indicative of port forwarding ('-l forward', '-P', '-R'), while filtering out legitimate executions of 'plink.exe' to reduce false positives.
Sigma
