Netcat reverse shell via mkfifo to attacker C2 208.123.119.215:3090
Detects the creation of a Linux named pipe (mkfifo) used in conjunction with netcat (nc) to establish a reverse shell connection to a specific C2 IP address or port 3090. This combination of commands is a common technique used by attackers to achieve remote command execution.
Microsoft Sentinel (KQL)
