Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
2
Contributors
1
1
Categories
2
2
2
1
Platforms
2
Products / Services
1
MITRE Techniques
2
2
1
CVEs
71
71
64
58
49
Identifies post-exploitation reverse shells resulting from the LiteLLM RCE vulnerabilities. The rule looks for processes initiated by 'litellm' (either directly or via python running litellm) that then spawn child processes with common reverse shell command line patterns such as 'bash -i', '/dev/tcp/', 'nc -e', or 'sh -i'.
Identifies post-exploitation reverse shells resulting from the LiteLLM RCE vulnerabilities. This rule specifically looks for process creation events where the parent process is associated with LiteLLM (either the 'litellm' executable or a Python process running 'litellm') and the spawned child process command line contains common reverse shell patterns such as 'bash -i', '/dev/tcp/', 'nc -e', or 'sh -i'.
