Potential Protocol Tunneling via Legit Utilities

process where event.action == "start" and
 (
  /* RDP port and usual SSH tunneling related switches in command line */
  (process.command_line : "*:3389*" and process.args : ("-L", "-P", "-R", "-pw", "-ssh")) or

  (process.code_signature.subject_name : "ngrok, Inc." and process.args : ("http", "tcp", "tunnel", "tls", "start", "3389")) or

  (process.executable : "?:\\Windows\\System32\\OpenSSH\\ssh.exe" and process.command_line : ("*127.0.0.*", "*:localhost:*") and process.args : "-L") or

  (process.args : "client" and process.command_line : "* R*:socks*") or

  ((process.name : "curl.exe" or process.pe.original_file_name == "curl.exe") and process.command_line : ("*socks5h://127.0.0.*", "*socks5h:\\127.0.0.*"))
 )
and not (process.code_signature.subject_name : "ninjaRMM LLC" and process.code_signature.status : "trusted") and
not (process.name:"ssh.exe" and process.args in ("22000:127.0.0.1:1466", "localhost:8897:localhost:8897", "22000:127.0.0.1:1466",
                                                 "10005:localhost:5050", "localhost:8897:localhost:8897", "59000:localhost:5901",
                                                 "-L30000:localhost:30000", "7779:localhost:7779", "5000:localhost:5000",
                                                 "8888:localhost:8888")) and
not process.parent.command_line : ("C:\\windows\\system32\\cmd.exe /c \"\"C:\\Users\\*\\Desktop\\*.bat\" \"",
                                   "\"C:\\Windows\\System32\\WindowsPowerShell\\v1.0\\powershell.exe\" ",
                                   "C:\\WINDOWS\\System32\\WindowsPowerShell\\v1.0\\powershell.exe")