It is very difficult for EDR to detect something like this, because it would look like a SSH connection.