From b9f4b91ad2843615e103f749781e4bd35a948be0 Mon Sep 17 00:00:00 2001
From: Ayush Anand <34771151+Securityinbits@users.noreply.github.com>
Date: Sat, 13 Jun 2026 17:11:28 +0800
Subject: [PATCH] Add ssh.exe to monitored image list for NetworkConnect

Testing if it handle other network connection made by ssh.exe in tunnel mode
---
 sysmonconfig-export.xml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/sysmonconfig-export.xml b/sysmonconfig-export.xml
index 8ba62b36..1208fdfb 100644
--- a/sysmonconfig-export.xml
+++ b/sysmonconfig-export.xml
@@ -332,6 +332,7 @@
 			<Image condition="image">WindowsTerminal.exe</Image>
 			<Image condition="image">wt.exe</Image>
 			<Image condition="image">winlogon.exe</Image>
+			<Image condition="image">ssh.exe</Image>
 			<!--Live of the Land Binaries and scripts (LOLBAS) -->
 			<Image condition="image">bitsadmin.exe</Image> <!-- Windows: Background Intelligent Transfer Service - Can download from URLs -->
 			<Image condition="image">esentutl.exe</Image> <!-- Windows: Database utilities for the ESE - Can fetch from UNC paths -->