SSH tunnels and proxies
A command resembles selected SSH forwarding or proxy options.
Why it is risky
Section titled “Why it is risky”A tunnel can expose a local service elsewhere or carry traffic around expected network controls. The risk depends on both endpoints and the service being forwarded.
Example
Section titled “Example”An agent creates a reverse SSH forward that makes a private development service reachable from an unfamiliar host.
This is a fictional example, not an event from a customer.
What Omnodex Detects
Section titled “What Omnodex Detects”The rule recognizes selected reverse, SOCKS, and local-forward command patterns in execution or staged content.
| Rule ID | Event category | Tier | Base severity |
|---|---|---|---|
RULE_THREAT_SSH_TUNNEL | threat_command | Community | MEDIUM |
Base severity is the rule default. A finding involving content saved for later execution may have a lower severity. Your loaded rule version and event details determine the finding you see.
What to check next
Section titled “What to check next”Verify the remote host, bind addresses, forwarded service, authentication, and task authorization. Close unexpected tunnels and review exposed service access.
False positives
Section titled “False positives”Authorized access through a bastion, remote debugging, and developer port forwarding are common legitimate uses.
False negatives
Section titled “False negatives”Alternative option syntax, SSH configuration files, other tunneling tools, or unsupported forwarding forms can be missed.
Technical details
Section titled “Technical details”The base severity is MEDIUM. A forwarding pattern does not prove that the tunnel connected or that someone used it.
A finding describes a pattern in captured activity. Review the original call, its result, and the task context before concluding that harm occurred. Absence of a finding does not establish that an operation is safe.