diff --git a/yml/OSBinaries/Ssh.yml b/yml/OSBinaries/Ssh.yml
index 71e7d0b9..a4d756ce 100644
--- a/yml/OSBinaries/Ssh.yml
+++ b/yml/OSBinaries/Ssh.yml
@@ -32,6 +32,15 @@ Commands:
     Tags:
       - Execute: DLL
       - Execute: Remote
+  - Command: ssh.exe -o "StrictHostKeyChecking=no" -o "PermitLocalCommand=yes" -o "LocalCommand=cmd.exe /q /c {CMD}" -q user@host
+    Description: Executes specified local command using the PermitLocalCommand and LocalCommand options upon initiating an SSH session. Can be used for defense evasion.
+    Usecase: Execute arbitrary local command via legitimate Windows OpenSSH client.
+    Category: Execute
+    Privileges: User
+    MitreID: T1202
+    OperatingSystem: Windows 10, Windows 11, Windows Server 2019, Windows Server 2022
+    Tags:
+      - Execute: CMD
 Full_Path:
   - Path: c:\windows\system32\OpenSSH\ssh.exe
 Code_Sample:
@@ -40,10 +49,17 @@ Detection:
   - Sigma: https://github.com/SigmaHQ/sigma/blob/c04bef2fbbe8beff6c7620d5d7ea6872dbe7acba/rules/windows/process_creation/proc_creation_win_lolbin_ssh.yml
   - IOC: Event ID 4624 with process name C:\Windows\System32\OpenSSH\sshd.exe.
   - IOC: command line arguments specifying execution.
+  - IOC: ssh.exe process creation containing PermitLocalCommand or LocalCommand in command line.
+  - IOC: ssh.exe spawning child processes such as cmd.exe or msiexec.exe.
 Resources:
   - Link: https://gtfobins.github.io/gtfobins/ssh/
   - Link: https://gist.github.com/screetsec/97d90750bfb058eb0b49c5374cdc0ac9
+  - Link: https://www.microsoft.com/en-us/security/blog/2026/09/29/star-blizzard-refines-phishing-and-malware-delivery-with-the-redflick-technique/
 Acknowledgement:
   - Person: Akshat Pradhan
   - Person: Felix Boulet
   - Person: Edo Maland
+  - Person: Will Dormann
+    Handle: '@wdormann'
+  - Person: Yared Henriquez
+    Handle: '@DevCop95'