huntrule

Suspicious Bash Reverse Shell via Dev TCP Redirection

PremiumReviewedSigma · High · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-11-05
Updated
2026-11-05
AnalysisDetection

ATT&CK techniques

Execution → C2

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a bash command redirecting a shell over the /dev/tcp pseudo device, the reverse shell technique used for hands on control after Ivanti EPMM exploitation. It is important because this pattern establishes an interactive channel to attacker infrastructure and precedes staging of Sliver beacons.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange
Suspicious Netcat Reverse Shell via Named Pipe on Linux via Process Creation (via process_creation)
Malicious Encrypted Reverse Shell via Netcat and GPG on Linux
Suspicious Reverse Shell via Dev TCP or Netcat
Malicious Bash Dev-TCP Reverse Shell via Shell (via process_creation)
Malicious Named Pipe Netcat Reverse Shell via Shell (via process_creation)
Suspicious Java Process Spawning Download or Shell Utility (Exposed JDWP Abuse)
Suspicious PostgreSQL Spawning Command Shell via COPY FROM PROGRAM (Soco404)
Suspicious Linux Payload Fetch Piping curl Output Into a Shell
Possible CUPS cups-browsed Remote Code Execution via Shell Child Process
Suspicious Bash Reverse Shell via Dev TCP Redirection
Pivot detection · T1059.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.