Reverse shell via mkfifo/netcat FIFO pipe with auto-reconnect loop
Detects the creation of a named pipe (FIFO) in the /tmp directory combined with commands associated with establishing a reverse shell, such as using 'nc' or executing '/bin/bash -i' with piped input/output redirection. These patterns are commonly used by adversaries to gain unauthorized interactive remote shell access to a Linux system.
Microsoft Sentinel (KQL)
