Reverse shell

Detects interactive reverse-shell primitives — /dev/tcp redirection, netcat -e, or a mkfifo named-pipe backpipe — used to hand an attacker an interactive shell over the network.

• T1059.004Command and Scripting Interpreter: Unix Shell· Execution

Automated health checks rarely use these primitives. Confirm the destination address and the parent process; a shell spawned by a web server or cron is high-signal.

Declarative YAML read by the detection engine — data, never executed. Confidence 75%. Source: rules/linux/reverse_shell.yaml, licensed under the Apache License 2.0.

id: linux.execution.reverse_shell
version: 1.0.0
status: stable
severity: critical
confidence: 0.75
platforms: [linux]
mitre_techniques: [T1059.004]
description: |
  Detects interactive reverse-shell primitives — /dev/tcp redirection, netcat -e, or a
  mkfifo named-pipe backpipe — used to hand an attacker an interactive shell over the network.
match:
  command_line_contains_any:
    - "/dev/tcp/"
    - "/dev/udp/"
    - "bash -i >&"
    - "sh -i >&"
    - "nc -e"
    - "ncat -e"
    - "mkfifo /tmp"
    - "rm /tmp/f;mkfifo"
false_positive_guidance: |
  Automated health checks rarely use these primitives. Confirm the destination address and
  the parent process; a shell spawned by a web server or cron is high-signal.

• Reverse shell auditdSeverity critical
• Dual use admin toolSeverity medium
• Known offensive toolSeverity high
• Curl pipe to shellSeverity high
• osascript abuseSeverity high
• Encoded PowerShell CommandSeverity high