Query Details

Plink Tunneling Forwarding

Query

DeviceProcessEvents
       | where ProcessCommandLine contains "*:" and ProcessCommandLine has_any("-L","-P", "-R", "-pw", "-ssh")| where InitiatingProcessFolderPath != @"/bin/bash" and  FolderPath != @"/bin/bash"

References:

About this query

Tags:

Query:

Explanation

The query is looking for DeviceProcessEvents where the ProcessCommandLine contains certain keywords and the InitiatingProcessFolderPath and FolderPath are not equal to "/bin/bash".