Detect Reverse Shell Command Execution

Ankit Mehta@Secvyn

•updated Jun 30, 2026•2•0•11

This rule detects potential reverse shell command execution by monitoring process creation events (EventID 4688) for specific command-line strings commonly associated with reverse shells. It looks for 'bash -i', '/bin/bash', 'nc -e', and 'powershell -NoP' in the command line.