Linux Reverse Shell via /bin/bash Connecting to External IPs

title: Linux Reverse Shell via /bin/bash Connecting to External IPs
id: 43191603-b1b2-4d15-8bdb-3084b295972f
status: test
description: This rule flags Linux network connections where the process image ends with /bin/bash and the destination IP is not 127.0.0.1 or 0.0.0.0. Remote bash connectivity is a common indicator of reverse shell activity, which attackers use to obtain interactive command execution over the network. The detection relies on process image path matching and destination IP telemetry from Linux network connection logs.
references:
  - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-16
modified: 2022-12-25
tags:
  - attack.execution
  - attack.t1059.004
logsource:
  product: linux
  category: network_connection
detection:
  selection:
    Image|endswith: /bin/bash
  filter:
    DestinationIp:
      - 127.0.0.1
      - 0.0.0.0
  condition: selection and not filter
falsepositives:
  - Unknown
level: critical
license: DRL-1.1
related:
  - id: 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871
    type: derived