OpenSSH abuse for lateral movement and external tunneling

Duo Tech@duotech

•updated Aug 11, 2026•5•0•15

Detects OpenSSH installation on Windows hosts, unexpected internal SSH sessions, and SSH tunnels terminating at an external (non-RFC1918) destination — particularly from SSL-VPN admin hosts — excluding documented DevOps CI/CD runners and known bastion hosts.