Operation Escaneo bind_shell.py Reverse Shell Tunneled via HTTP Ports 80/443/8080

Ibrahim Saud@tektrix

•updated Jun 25, 2026•0•0•1

Detects anomalous network connections to HTTP/S ports (80, 443, 8080) by suspicious processes (e.g., Python, Netcat, Socat) or those executing known tunneling/web shell scripts (Neo-reGeorg, Chisel). This rule identifies potential egress-blocked environment bypass attempts by monitoring for high-frequency outbound connections that deviate from standard browser or signed-application behavior.