title: Linux Reverse Shell Command Line
id: 4938e3a4-dd31-4171-b413-d0d04f0cc6aa
status: experimental
description: Detects shell command lines that redirect a shell through a network socket, or a network tool run with an execute option.
author: WMouton
date: 2026/10/04
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    category: process_creation
    product: linux
detection:
    selection_devtcp:
        CommandLine|contains|all:
            - '/dev/tcp/'
            - 'sh'
    selection_netcat:
        Image|endswith:
            - '/nc'
            - '/ncat'
            - '/netcat'
        CommandLine|contains:
            - ' -e '
            - ' -c '
    condition: 1 of selection_*
falsepositives:
    - Administrators testing connectivity with /dev/tcp in a script
    - Legitimate use of netcat with an execute option on a test host
level: high