{"id":"738d9bcf-6999-4fdb-b4ac-3033037db8ab","title":"Suspicious Reverse Shell Command Line","description":"Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell","author":"Florian Roth (Nextron Systems)","status":"test","level":"high","date":"2019-04-02","modified":"2021-11-27","tags":["attack.execution","attack.t1059.004"],"technique_ids":["T1059.004"],"logsource":{"product":"linux"},"falsepositives":["Unknown"],"references":["https://alamot.github.io/reverse_shells/"],"source_path":"rules/linux/builtin/lnx_shell_susp_rev_shells.yml","source_sha256":"c81f97017992bebadc7078d631bdbc92475e2db0efce7666d720ecf7e019faa8","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_shell_susp_rev_shells.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Suspicious Reverse Shell Command Line\nid: 738d9bcf-6999-4fdb-b4ac-3033037db8ab\nstatus: test\ndescription: Detects suspicious shell commands or program code that may be executed or used in command line to establish a reverse shell\nreferences:\n    - https://alamot.github.io/reverse_shells/\nauthor: Florian Roth (Nextron Systems)\ndate: 2019-04-02\nmodified: 2021-11-27\ntags:\n    - attack.execution\n    - attack.t1059.004\nlogsource:\n    product: linux\ndetection:\n    keywords:\n        - 'BEGIN {s = \"/inet/tcp/0/'\n        - 'bash -i >& /dev/tcp/'\n        - 'bash -i >& /dev/udp/'\n        - 'sh -i >$ /dev/udp/'\n        - 'sh -i >$ /dev/tcp/'\n        - '&& while read line 0<&5; do'\n        - '/bin/bash -c exec 5<>/dev/tcp/'\n        - '/bin/bash -c exec 5<>/dev/udp/'\n        - 'nc -e /bin/sh '\n        - '/bin/sh | nc'\n        - 'rm -f backpipe; mknod /tmp/backpipe p && nc '\n        - ';socket(S,PF_INET,SOCK_STREAM,getprotobyname(\"tcp\"));if(connect(S,sockaddr_in($p,inet_aton($i))))'\n        - ';STDIN->fdopen($c,r);$~->fdopen($c,w);system$_ while<>;'\n        - '/bin/sh -i <&3 >&3 2>&3'\n        - 'uname -a; w; id; /bin/bash -i'\n        - '$sendbyte = ([text.encoding]::ASCII).GetBytes($sendback2); $stream.Write($sendbyte,0,$sendbyte.Length); $stream.Flush()};'\n        - ';os.dup2(s.fileno(),0);os.dup2(s.fileno(),1);os.dup2(s.fileno(),2);os.putenv(''HISTFILE'',''/dev/null'');'\n        - '.to_i;exec sprintf(\"/bin/sh -i <&%d >&%d 2>&%d\",f,f,f)'\n        - ';while(cmd=c.gets);IO.popen(cmd,\"r\"){|io|c.print'\n        - 'socat exec:''bash -li'',pty,stderr,setsid,sigint,sane tcp:'\n        - 'rm -f /tmp/p; mknod /tmp/p p &&'\n        - ' | /bin/bash | telnet '\n        - ',echo=0,raw tcp-listen:'\n        - 'nc -lvvp '\n        - 'xterm -display 1'\n    condition: keywords\nfalsepositives:\n    - Unknown\nlevel: high\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1059.004","id":"T1059.004","name":"Unix Shell","page":"techniques/enterprise/T1059.004/"}],"data_path":"data/detection-rules/738d9bcf-6999-4fdb-b4ac-3033037db8ab.json","kind":"sigma"}