Agent Establishing an Encrypted Reverse Channel or Tunnel - ATR-2026-01994 (27e7039d-f2d3-57d0-af99-8867c7fdf631)
Detects an agent tool call that opens a covert encrypted channel out of the
host: an openssl/ncat TLS reverse shell, an ssh -R remote-forward tunnel to
an external endpoint, or a public tunnel (ngrok/cloudflared/localtunnel)
exposing an internal service. This is the agent-context form of ATT&CK T1573
(Encrypted Channel) — encrypted egress used to hide C2 or data movement.
Detects: TLS reverse-shell one-liners, reverse SSH forwards, public
tunnel exposure of internal ports.
Does NOT detect: ordinary HTTPS requests, or a normal deploy to a managed
platform (vercel/railway), or a local SSH forward for dev.