Potential Netcat Reverse Shell Execution

 1title: Potential Netcat Reverse Shell Execution
 2id: 7f734ed0-4f47-46c0-837f-6ee62505abd9
 3status: test
 4description: |
 5        Detects execution of netcat with the "-e" or "-c" flags followed by common shells, which are commonly used to spawn reverse shells.
 6references:
 7    - https://pentestmonkey.net/cheat-sheet/shells/reverse-shell-cheat-sheet
 8    - https://www.revshells.com/
 9    - https://www.hackingtutorials.org/networking/hacking-netcat-part-2-bind-reverse-shells/
10    - https://www.infosecademy.com/netcat-reverse-shells/
11    - https://man7.org/linux/man-pages/man1/ncat.1.html
12author: '@d4ns4n_, Nasreddine Bencherchali (Nextron Systems)'
13date: 2023-04-07
14modified: 2026-09-24
15tags:
16    - attack.execution
17    - attack.t1059
18logsource:
19    category: process_creation
20    product: linux
21detection:
22    selection_nc:
23        Image|endswith:
24            - '/nc.openbsd'
25            - '/nc.traditional'
26            - '/nc'
27            - '/ncat'
28            - '/netcat.openbsd'
29            - '/netcat.traditional'
30            - '/netcat'
31    selection_flags:
32        CommandLine|contains:
33            - ' -c '
34            - ' -e '
35    selection_shell:
36        CommandLine|contains:
37            - ' ash'
38            - ' bash'
39            - ' bsh'
40            - ' csh'
41            - ' ksh'
42            - ' pdksh'
43            - ' sh'
44            - ' tcsh'
45            - '/bin/ash'
46            - '/bin/bash'
47            - '/bin/bsh'
48            - '/bin/csh'
49            - '/bin/ksh'
50            - '/bin/pdksh'
51            - '/bin/sh'
52            - '/bin/tcsh'
53            - '/bin/zsh'
54            - '$IFSash'
55            - '$IFSbash'
56            - '$IFSbsh'
57            - '$IFScsh'
58            - '$IFSksh'
59            - '$IFSpdksh'
60            - '$IFSsh'
61            - '$IFStcsh'
62            - '$IFSzsh'
63    condition: all of selection_*
64falsepositives:
65    - Unlikely
66level: high

References

• Reverse Shell Cheat Sheet

  If you’re lucky enough to find a command execution vulnerability during a penetration test, pretty soon afterwards you’ll probably want an interactive shell. If it’s not possible to add a new accou...

  
  Read More

• Online - Reverse Shell Generator

  

  Online Reverse Shell generator with Local Storage functionality, URI & Base64 Encoding, MSFVenom Generator, and Raw Mode. Great for CTFs.

  
  Read More

• Hacking with Netcat part 2: Bind and reverse shells - Hacking Tutorials

  

  In part 2 of hacking with Netcat we will be learning about bind shells and reverse shells on Windows and Linux using Netcat, Python, PHP, Perl and Bash.

  
  Read More

• Netcat Reverse Shells And How They Are Used By Pentesters

  

  Netcat reverse shells are the endgame for pentesters. This step-by-step guide shows you how to create your own reverse shell using Netcat.

  
  Read More

• ncat(1) - Linux manual page

  

  HTML rendering created 2026-09-09 by Michael Kerrisk, author of The Linux Programming Interface. For details of in-depth Linux/UNIX system programming training courses that I teach, look here. Host...

  
  Read More

Related rules

• Potentially Suspicious NTFS Symlink Behavior Modification
• Suspicious Scan Loop Network
• PowerShell Download and Execution Cradles
• Script Interpreter Execution From Suspicious Folder
• Suspicious Program Names