NightEagle RDP tunneling via Microsoft dev tunnels (devtunnels.ms)
Detects outbound TLS connections to Microsoft Dev Tunnels (devtunnels.ms), which can be abused for lateral movement or protocol tunneling of services such as RDP to bypass network ingress filtering.
Suricata
