JexBoss Command Sequence Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•22

This rule detects a suspicious command sequence often associated with the JexBoss exploitation tool. Specifically, it looks for the execution of 'bash -c /bin/bash' followed by a network connection attempt using '&/dev/tcp/'. This combination indicates an attempt to establish a reverse shell or exfiltrate data over TCP.