Linux Network Connection to /bin/bash via Reverse Shell Pattern
Alerts on /bin/bash network connections to non-local destination IPs, consistent with reverse shell behavior.
- Product
- linux
- Category
- network_connection
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-10-16
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags network activity where the process image ends with '/bin/bash' and the destination IP is not 127.0.0.1 or 0.0.0.0. Outbound connections initiated by an interactive shell are a common indicator of reverse shell behavior used to establish remote command execution. It relies on telemetry that correlates the executable path (process image) with destination IP for Linux network connection events.
Reporting behind it
- github.comhttps://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Network Connection to /bin/bash via Reverse Shell Pattern
id: 43191603-b1b2-4d15-8bdb-3084b295972f
status: test
description: This rule flags network activity where the process image ends with '/bin/bash' and the destination IP is not 127.0.0.1 or 0.0.0.0. Outbound connections initiated by an interactive shell are a common indicator of reverse shell behavior used to establish remote command execution. It relies on telemetry that correlates the executable path (process image) with destination IP for Linux network connection events.
references:
- https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2021-10-16
modified: 2022-12-25
tags:
- attack.execution
- attack.t1059.004
logsource:
product: linux
category: network_connection
detection:
selection:
Image|endswith: /bin/bash
filter:
DestinationIp:
- 127.0.0.1
- 0.0.0.0
condition: selection and not filter
falsepositives:
- Unknown
level: critical
license: DRL-1.1
related:
- id: 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871
type: derived