Netcat reverse shell via mkfifo to Cisco FMC attacker C2

Arnold Chan@slaz

•updated Sep 10, 2026•1•0•4

Detects the execution of a reverse shell on Linux systems utilizing a common technique involving mkfifo (named pipe) to redirect input/output for a shell session to a netcat network connection. This is often used by attackers to gain interactive remote access to a compromised host.