Reverse shell auditd
An interactive reverse shell executed on Linux (bash /dev/tcp, nc -e, or a Python socket one-liner) — attacker-controlled remote command execution.
What it detects
An interactive reverse shell executed on Linux (bash /dev/tcp, nc -e, or a Python socket one-liner) — attacker-controlled remote command execution. Matches whether the command line arrives via auditd EXECVE or shell/syslog evidence.
MITRE ATT&CK mapping
- T1059.004Command and Scripting Interpreter: Unix Shell· Execution
False positives and triage
Legitimate remote administration rarely uses these exact patterns. Confirm the destination and parent process; automation may use nc without -e.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 80%. Source: rules/linux/reverse_shell_auditd.yaml, licensed under the Apache License 2.0.
id: linux.execution.reverse_shell_auditd
version: 1.0.0
status: stable
severity: critical
confidence: 0.8
platforms: [linux]
mitre_techniques: [T1059.004]
description: |
An interactive reverse shell executed on Linux (bash /dev/tcp, `nc -e`, or a
Python socket one-liner) — attacker-controlled remote command execution. Matches
whether the command line arrives via auditd EXECVE or shell/syslog evidence.
match:
command_line_regex: '(?i)(bash\s+-i.*(/dev/tcp/|/dev/udp/))|(\bnc\b|\bncat\b).*\s-e\s|python3?\s.*socket.*(connect|SOCK_STREAM).*(subprocess|pty|/bin/(ba)?sh)'
false_positive_guidance: |
Legitimate remote administration rarely uses these exact patterns. Confirm the
destination and parent process; automation may use nc without -e.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.