SPECTRALVIPER Reverse Shell Creation
Detects reverse shell commands commonly established by SPECTRALVIPER to connect back to Miasma C2 infrastructure over /dev/tcp. This rule specifically looks for process creation events where the command line contains a bash, sh, or zsh command initiating an interactive shell and redirecting I/O to a /dev/tcp connection to an IP address and port, then redirecting stderr to stdout.
Microsoft Sentinel (KQL)
