Sigma rule: Potential Netcat Reverse Shell Execution

Rule

Title

Potential Netcat Reverse Shell Execution

Status

test

Level

high

Author

@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)

Date

2023-04-07

Modified

2026-09-24

File

rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of netcat with the "-e" or "-c" flags followed by common shells, which are commonly used to spawn reverse shells.

Log source

product

linux

category

process_creation

Detection

selection_nc:
    Image|endswith:
        - '/nc.openbsd'
        - '/nc.traditional'
        - '/nc'
        - '/ncat'
        - '/netcat.openbsd'
        - '/netcat.traditional'
        - '/netcat'
selection_flags:
    CommandLine|contains:
        - ' -c '
        - ' -e '
selection_shell:
    CommandLine|contains:
        - ' ash'
        - ' bash'
        - ' bsh'
        - ' csh'
        - ' ksh'
        - ' pdksh'
        - ' sh'
        - ' tcsh'
        - '/bin/ash'
        - '/bin/bash'
        - '/bin/bsh'
        - '/bin/csh'
        - '/bin/ksh'
        - '/bin/pdksh'
        - '/bin/sh'
        - '/bin/tcsh'
        - '/bin/zsh'
        - '$IFSash'
        - '$IFSbash'
        - '$IFSbsh'
        - '$IFScsh'
        - '$IFSksh'
        - '$IFSpdksh'
        - '$IFSsh'
        - '$IFStcsh'
        - '$IFSzsh'
condition: all of selection_*

False positives (as the rule lists them)

• Unlikely

Tags

• attack.execution
• attack.t1059

MITRE ATT&CK ids this rule names

• T1059

References

• https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
• https://www.revshells.com/
• https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/
• https://www.infosecademy.com/netcat-reverse-shells/
• https://man7.org/linux/man-pages/man1/ncat.1.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/process_creation/proc_creation_lnx_netcat_reverse_shell.yml