Linux JexBoss Suspicious Bash Command Launch with /dev/tcp

Flags Linux executions containing bash -c /bin/bash paired with /dev/tcp/ indicative of a reverse-shell command sequence.

FreeReviewedSigma · High · v3

Product: linux
Author: Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2017-08-24
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution

Recon
Resource Dev
Initial Access
Execution
- T1059.004Unix Shell
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule matches a suspicious Linux command sequence where a bash instance is invoked via "bash -c /bin/bash" and includes a redirect to a network-capable "&/dev/tcp/" path. Such behavior is relevant because it aligns with common attacker tradecraft for establishing network communications or payload staging from shell commands. Telemetry relies on Linux command text/logs that capture the executed command line containing both keywords.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange

Possible Remote Payload Download And Execution via Shell (via process_creation)

Suspicious EtherRAT Node.js Implant Background Execution via Shell (via process_creation)

Malicious EtherRAT Base64 Decoded Payload Piped To Bash via Shell (via process_creation)

Suspicious Bash Decode Chain Using curl xxd and base64 Piped to eval via Linux Shell

Malicious Download Piped to Shell via curl or wget (via process_creation)

Suspicious GobRAT Bulbature Infection Shell Scripts Execution

Suspicious Base64 Decoded Payload Piped to Shell on Linux

Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)

Suspicious OpenClaw Skill File Modification via File Event

Linux JexBoss Suspicious Bash Command Launch with /dev/tcp

Pivot detection · T1059.004 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-jexboss-like-reverse-shell-command-sequence-via-bash-with-dev-tcp-8ec2c8b4

title: Linux JexBoss Suspicious Bash Command Launch with /dev/tcp
id: 3801e19b-4dcb-46c2-99b1-730915c3d172
status: test
description: This rule matches a suspicious Linux command sequence where a bash instance is invoked via "bash -c /bin/bash" and includes a redirect to a network-capable "&/dev/tcp/" path. Such behavior is relevant because it aligns with common attacker tradecraft for establishing network communications or payload staging from shell commands. Telemetry relies on Linux command text/logs that capture the executed command line containing both keywords.
references:
  - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_susp_jexboss.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-08-24
modified: 2025-11-22
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
detection:
  keywords:
    "|all":
      - bash -c /bin/bash
      - "&/dev/tcp/"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8ec2c8b4-557a-4121-b87c-5dfb3a602fae
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL