Suspicious /dev/tcp Usage in Linux Shell Commands
Flags Linux shell commands containing suspicious /dev/tcp redirection and file descriptor constructs.
FreeReviewedSigma · Medium · v3
- Product
- linux
- Author
- frack113 (SigmaHQ), DRL 1.1
- Published
- 2021-12-10
- Updated
- 2026-07-31
What it detects
This rule flags Linux commands containing common /dev/tcp I/O redirection patterns, such as exec/dup file descriptors and interactive shells redirecting to /dev/tcp or /dev/udp. Attackers often use /dev/tcp to establish outbound network connectivity directly from shell tooling and to stage interactive access or reconnaissance. It relies on command-line text telemetry matching specific keyword fragments associated with these redirection techniques.
Reporting behind it
- andreafortuna.orghttps://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/
- book.hacktricks.xyzhttps://book.hacktricks.xyz/shells/shells/linux
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_susp_dev_tcp.yml
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
linux-suspicious-dev-tcp-shell-redirection-and-file-descriptor-usage-6cc5fceb
title: Suspicious /dev/tcp Usage in Linux Shell Commands
id: 909fe358-3600-46d8-9e00-867dd02ea616
status: test
description: This rule flags Linux commands containing common /dev/tcp I/O redirection patterns, such as exec/dup file descriptors and interactive shells redirecting to /dev/tcp or /dev/udp. Attackers often use /dev/tcp to establish outbound network connectivity directly from shell tooling and to stage interactive access or reconnaissance. It relies on command-line text telemetry matching specific keyword fragments associated with these redirection techniques.
references:
- https://www.andreafortuna.org/2021/03/06/some-useful-tips-about-dev-tcp/
- https://book.hacktricks.xyz/shells/shells/linux
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1046/T1046.md#atomic-test-1---port-scan
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_susp_dev_tcp.yml
author: frack113, Huntrule Team
date: 2021-12-10
modified: 2023-01-06
tags:
- attack.reconnaissance
logsource:
product: linux
detection:
keywords:
- cat </dev/tcp/
- exec 3<>/dev/tcp/
- echo >/dev/tcp/
- bash -i >& /dev/tcp/
- sh -i >& /dev/udp/
- 0<&196;exec 196<>/dev/tcp/
- exec 5<>/dev/tcp/
- (sh)0>/dev/tcp/
- bash -c 'bash -i >& /dev/tcp/
- echo -e '#!/bin/bash\nbash -i >& /dev/tcp/
condition: keywords
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 6cc5fceb-9a71-4c23-aeeb-963abe0b279c
type: derived