Reverse Shell Spawned by LiteLLM (CVE-2026-40217)

Ethan Andrews@eandrews

•updated Jun 15, 2026•12•0•27

Identifies post-exploitation reverse shells resulting from the LiteLLM RCE vulnerabilities. This rule specifically looks for process creation events where the parent process is associated with LiteLLM (either the 'litellm' executable or a Python process running 'litellm') and the spawned child process command line contains common reverse shell patterns such as 'bash -i', '/dev/tcp/', 'nc -e', or 'sh -i'.