Linux Suspicious Reverse Shell Command-Line Execution Patterns
Alerts on Linux command lines containing reverse-shell-style strings such as /dev/tcp redirections, netcat pipes, and socket connect patterns.
- Product
- linux
- Author
- Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2019-04-02
- Updated
- 2026-07-31
ATT&CK techniques
ExecutionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule matches command-line text containing known reverse-shell oriented patterns, including bash/sh interactive shells redirected through /dev/tcp or /dev/udp, netcat/socat/telnet style payloads, and other code-like constructs commonly used to open outbound connections. Such behavior is commonly leveraged by attackers to establish interactive remote access back to a command-and-control system. It relies on Linux command-line telemetry that contains these specific string patterns.
Reporting behind it
Changelog
v3- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: Linux Suspicious Reverse Shell Command-Line Execution Patterns
id: 8a33aec6-4a6e-4199-96d6-7263fefd1261
status: test
description: This rule matches command-line text containing known reverse-shell oriented patterns, including bash/sh interactive shells redirected through /dev/tcp or /dev/udp, netcat/socat/telnet style payloads, and other code-like constructs commonly used to open outbound connections. Such behavior is commonly leveraged by attackers to establish interactive remote access back to a command-and-control system. It relies on Linux command-line telemetry that contains these specific string patterns.
references:
- https://alamot.github.io/reverse_shells/
- https://github.com/SigmaHQ/sigma/blob/master/rules/linux/builtin/lnx_shell_susp_rev_shells.yml
author: Florian Roth (Nextron Systems), Huntrule Team
date: 2019-04-02
modified: 2021-11-27
tags:
- attack.execution
- attack.t1059.004
logsource:
product: linux
detection:
keywords:
- BEGIN {s = "/inet/tcp/0/
- bash -i >& /dev/tcp/
- bash -i >& /dev/udp/
- sh -i >$ /dev/udp/
- sh -i >$ /dev/tcp/
- "&& while read line 0<&5; do"
- /bin/bash -c exec 5<>/dev/tcp/
- /bin/bash -c exec 5<>/dev/udp/
- "nc -e /bin/sh "
- /bin/sh | nc
- "rm -f backpipe; mknod /tmp/backpipe p && nc "
- ;socket(S,PF_INET,SOCK_STREAM,getprotobyname("tcp"));if(connect(S,sockaddr_in($p,inet_aton($i))))
- ;STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;
- /bin/sh -i <&3 >&3 2>&3
- uname -a; w; id; /bin/bash -i
- $sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()};
- ;os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv('HISTFILE','/dev/null');
- .to_i;exec sprintf("/bin/sh -i <&%d >&%d 2>&%d",f,f,f)
- ;while(cmd=c.gets);IO.popen(cmd,"r"){|io|c.print
- "socat exec:'bash -li',pty,stderr,setsid,sigint,sane tcp:"
- rm -f /tmp/p; mknod /tmp/p p &&
- " | /bin/bash | telnet "
- ",echo=0,raw tcp-listen:"
- "nc -lvvp "
- xterm -display 1
condition: keywords
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 738d9bcf-6999-4fdb-b4ac-3033037db8ab
type: derived