Windows Process Creation: Netcat (ncat/cat) Suspicious Execution
Alerts on Windows process launches of Netcat-like binaries with typical listener/proxy or remote execution command-line flags.
- Product
- windows
- Category
- process_creation
- Author
- frack113, Florian Roth (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2021-07-21
- Updated
- 2026-07-30
ATT&CK techniques
C2Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
Exfiltration
Impact
What it detects
This rule flags Windows process executions where the executable name ends with ncat.exe/cat.exe/netcat.exe and the command line contains common Netcat listener/proxy and remote command execution parameters. Adversaries often use Netcat-like tools to establish non-application-layer communication channels for C2 or lateral movement within a network. The detection relies on process creation telemetry capturing the process image path and the full command line.
Reporting behind it
- nmap.orghttps://nmap.org/ncat/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
- revshells.comhttps://www.revshells.com/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_netcat.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Process Creation: Netcat (ncat/cat) Suspicious Execution"
id: 2e2fdce7-0b1a-41d8-a697-90eccb7131d2
status: test
description: This rule flags Windows process executions where the executable name ends with ncat.exe/cat.exe/netcat.exe and the command line contains common Netcat listener/proxy and remote command execution parameters. Adversaries often use Netcat-like tools to establish non-application-layer communication channels for C2 or lateral movement within a network. The detection relies on process creation telemetry capturing the process image path and the full command line.
references:
- https://nmap.org/ncat/
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
- https://www.revshells.com/
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_netcat.yml
author: frack113, Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-21
modified: 2023-02-08
tags:
- attack.command-and-control
- attack.t1095
logsource:
category: process_creation
product: windows
detection:
selection_img:
Image|endswith:
- \nc.exe
- \ncat.exe
- \netcat.exe
selection_cmdline:
CommandLine|contains:
- " -lvp "
- " -lvnp"
- " -l -v -p "
- " -lv -p "
- " -l --proxy-type http "
- " -vnl --exec "
- " -vnl -e "
- " --lua-exec "
- " --sh-exec "
condition: 1 of selection_*
falsepositives:
- Legitimate ncat use
level: high
license: DRL-1.1
related:
- id: e31033fc-33f0-4020-9a16-faf9b31cbf08
type: derived