Linux: JexBoss-like reverse shell command sequence via bash with /dev/tcp

Flags Linux executions containing bash -c /bin/bash paired with /dev/tcp/ indicative of a reverse-shell command sequence.

FreeUnreviewedSigmahighv1

linux-jexboss-like-reverse-shell-command-sequence-via-bash-with-dev-tcp-8ec2c8b4

title: "Linux: JexBoss-like reverse shell command sequence via bash with /dev/tcp"
id: 3801e19b-4dcb-46c2-99b1-730915c3d172
status: test
description: This rule matches a suspicious execution pattern where a command invokes a bash shell using "bash -c /bin/bash" and includes a TCP redirection using "/dev/tcp/". Such sequences are often used to establish interactive or command/control access from a compromised host. Detection relies on Linux command-line or process execution telemetry containing these exact keyword fragments.
references:
  - https://www.us-cert.gov/ncas/analysis-reports/AR18-312A
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_susp_jexboss.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2017-08-24
modified: 2025-11-22
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
detection:
  keywords:
    "|all":
      - bash -c /bin/bash
      - "&/dev/tcp/"
  condition: keywords
falsepositives:
  - Unknown
level: high
license: DRL-1.1
related:
  - id: 8ec2c8b4-557a-4121-b87c-5dfb3a602fae
    type: derived

What it detects

This rule matches a suspicious execution pattern where a command invokes a bash shell using "bash -c /bin/bash" and includes a TCP redirection using "/dev/tcp/". Such sequences are often used to establish interactive or command/control access from a compromised host. Detection relies on Linux command-line or process execution telemetry containing these exact keyword fragments.

Known false positives

Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.