huntrule

Suspicious Reverse Shell via bash to dev tcp (via process_creation)

PremiumReviewedSigma · High · v1
Product
linux
Category
process_creation
Author
HuntRule
Published
2026-09-16
Updated
2026-09-16
AnalysisDetection

ATT&CK techniques

Execution

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule detects a bash interactive reverse shell using the /dev/tcp pseudo-device, executed post-exploitation of SAP NetWeaver to reach attacker infrastructure. This construct redirects an interactive shell over a raw TCP socket. Legitimate administrators almost never spawn shells this way.

Reporting behind it

Related detections9 linkedT1059.004 — drag to rearrange
Suspicious Exfiltration of Environment File via wget POST
Malicious Node.js Process Spawning Unix Shell or Network Client
Malicious Encrypted Reverse Shell via Netcat and GPG on Linux
Suspicious Reverse Shell via Dev TCP or Netcat
Suspicious Base64 Decoded Payload Piped to Shell
Suspicious Shell Spawned by ActiveMQ Java Process
Suspicious Bad Apples Reverse Shell via socat pty
Suspicious Axios NPM macOS Persistence Masquerading as Apple Service
Malicious Shell Payload Piped from curl to zsh
Suspicious Reverse Shell via bash to dev tcp (via process_creation)
Pivot detection · T1059.004 · 9 related

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.