Sequential id_tunnel.pub then id_tunnel fetch followed by SSH tunnel to port 4000

ills3c Intel&Coffee@Ills3C

•updated yesterday•0•0•1

Detects a sequence of process execution events where a device first downloads a public key (id_tunnel.pub) using curl or wget, subsequently downloads a private/tunnel key file (id_tunnel), and finally establishes an SSH tunnel or port forwarding session using ssh or a tun4000 script within a 4-hour window.