Detected Potential SSH Tunnel Persistence via Task Scheduler

Kaung Khant Ko@kaungkhantko

•updated Jul 17, 2025•11•5•116

Detects the creation of new scheduled tasks through Schtasks.exe, specifically those invoking OpenSSH, which could indicate an attempt to establish a reverse SSH tunnel to a remote attacker's server.