Linux Suspicious /dev/tcp Shell Redirection and File Descriptor Usage

title: Linux Suspicious /dev/tcp Shell Redirection and File Descriptor Usage
id: 909fe358-3600-46d8-9e00-867dd02ea616
status: test
description: This rule identifies Linux shell commands that reference /dev/tcp patterns used to create network connections via shell redirection and file descriptors. Attackers can leverage /dev/tcp for discovery, staging, and command-and-control-style behavior without dedicated network utilities. It relies on keyword matches in available command or script content telemetry for the listed /dev/tcp usage forms.
references:
  - https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/
  - https://book.hacktricks.xyz/shells/shells/linux
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_susp_dev_tcp.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-01-06
tags:
  - attack.reconnaissance
logsource:
  product: linux
detection:
  keywords:
    - cat </dev/tcp/
    - exec 3<>/dev/tcp/
    - echo >/dev/tcp/
    - bash -i >& /dev/tcp/
    - sh -i >& /dev/udp/
    - 0<&196;exec 196<>/dev/tcp/
    - exec 5<>/dev/tcp/
    - (sh)0>/dev/tcp/
    - bash -c 'bash -i >& /dev/tcp/
    - echo -e '#!/bin/bash\nbash -i >& /dev/tcp/
  condition: keywords
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c
    type: derived