SSH remote forwarding uses an SSH connection to expose a service reachable from one side of the connection through a port on the other side. In an intrusion, an attacker with access to a compromised host may use it to route connections into internal services, creating a tunnel that can be less visible than direct access.
This matters because a tunnel can turn one foothold into a path toward systems that are not exposed to the public internet. Defenders can look for unexpected SSH sessions, forwarding options, unusual listening ports, and outbound connections that persist beyond normal administrative use. Restricting SSH access and monitoring network and host activity together can help detect or prevent covert forwarding.