Windows Process Creation: Netcat (ncat/cat) Suspicious Execution

title: "Windows Process Creation: Netcat (ncat/cat) Suspicious Execution"
id: 2e2fdce7-0b1a-41d8-a697-90eccb7131d2
status: test
description: This rule flags Windows process executions where the executable name ends with ncat.exe/cat.exe/netcat.exe and the command line contains common Netcat listener/proxy and remote command execution parameters. Adversaries often use Netcat-like tools to establish non-application-layer communication channels for C2 or lateral movement within a network. The detection relies on process creation telemetry capturing the process image path and the full command line.
references:
  - https://nmap.org/ncat/
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1095/T1095.md
  - https://www.revshells.com/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_pua_netcat.yml
author: frack113, Florian Roth (Nextron Systems), Huntrule Team
date: 2021-07-21
modified: 2023-02-08
tags:
  - attack.command-and-control
  - attack.t1095
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    Image|endswith:
      - \nc.exe
      - \ncat.exe
      - \netcat.exe
  selection_cmdline:
    CommandLine|contains:
      - " -lvp "
      - " -lvnp"
      - " -l -v -p "
      - " -lv -p "
      - " -l --proxy-type http "
      - " -vnl --exec "
      - " -vnl -e "
      - " --lua-exec "
      - " --sh-exec "
  condition: 1 of selection_*
falsepositives:
  - Legitimate ncat use
level: high
license: DRL-1.1
related:
  - id: e31033fc-33f0-4020-9a16-faf9b31cbf08
    type: derived