Potential Xterm Reverse Shell Detection

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•22

Detects the execution of 'xterm' with command-line arguments indicative of a reverse shell connection, specifically looking for '-display' and a display value ending in ':1'. This pattern is commonly used by attackers to establish a reverse shell.