Suspicious Shell Execution from Media Processing Applications

nomit vyas@xoxo

•updated Jun 25, 2026•1•0•6

This rule detects potentially malicious shell execution (e.g., bash -i, /dev/tcp/ reverse shells, netcat) spawned directly or indirectly by common media processing applications such as ffmpeg, ffprobe, jellyfin, or nextcloud. It identifies when these applications initiate shell processes or execute command lines that exhibit suspicious behavior or access specific media-related paths commonly targeted for abuse.