Linux reverse shell started from a command line

Threat behaviour covered

A reverse shell connects an interactive shell back to an attacker. On Linux it is often a one-line command that redirects a shell through a network socket, either with Bash's built-in /dev/tcp or with a network tool run with an execute option. The rule flags those command lines.

Detection logic

title: Linux Reverse Shell Command Line
id: 4938e3a4-dd31-4171-b413-d0d04f0cc6aa
status: experimental
description: Detects shell command lines that redirect a shell through a network socket, or a network tool run with an execute option.
author: WMouton
date: 2026/10/04
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_devtcp:
        CommandLine|contains|all:
            - '/dev/tcp/'
            - 'sh'
    selection_netcat:
        Image|endswith:
            - '/nc'
            - '/ncat'
            - '/netcat'
        CommandLine|contains:
            - ' -e '
            - ' -c '
    condition: 1 of selection_*
falsepositives:
    - Administrators testing connectivity with /dev/tcp in a script
    - Legitimate use of netcat with an execute option on a test host
level: high

Data sources

• Linux process creation events with command lines: auditd execve records, Sysmon for Linux event ID 1, or an EDR sensor

False positives and tuning

• Connectivity checks written as echo > /dev/tcp/host/port do not start a shell; the sh condition limits matches, but review them anyway.
• Allow-list known admin hosts and maintenance scripts by parent process or user.

Limitations

• Does not see a reverse shell written in a scripting language or compiled binary that opens the socket itself. Pair it with outbound connection monitoring from shell processes.