Reverse Shell Spawned by LiteLLM (CVE-2026-40217)

nomit vyas@xoxo

•updated Jun 24, 2026•2•0•19

Identifies post-exploitation reverse shells resulting from the LiteLLM RCE vulnerabilities. The rule looks for processes initiated by 'litellm' (either directly or via python running litellm) that then spawn child processes with common reverse shell command line patterns such as 'bash -i', '/dev/tcp/', 'nc -e', or 'sh -i'.