Potential Netcat Reverse Shell Execution

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•23

Detects the execution of netcat or ncat with the '-e' or '-c' flag, combined with common shell commands. This pattern is indicative of an attempt to establish a reverse shell, where a shell is spawned and connected back to an attacker-controlled listener.