[varenc]

A corporate IT admin would probably detect this by pulling information directly from the company managed machines. i.e. osquery

https://www.metalliccode.com/detecting-ssh-tunnels