PowerShell installs OpenSSH from OpenSSH-Win64.zip with sshd autostart and TCP
Detects a sequence of events on a single device where PowerShell is used to download or install OpenSSH, followed shortly by configuring the sshd service to start automatically or creating an inbound firewall rule for TCP port 22.
Microsoft Sentinel (KQL)
