medium advisory July 29, 2026

Netcat Listener or File Transfer Detected in Containers

This threat brief details the detection of malicious Netcat usage within Linux containers, indicating potential backdoor establishment, persistence, command and control, or data exfiltration by adversaries.

Adversaries commonly leverage the versatile Netcat utility for various malicious purposes, including establishing backdoors for persistence, creating reverse shells for remote command execution, or facilitating data exfiltration and file transfer within compromised environments. This threat brief focuses on the detection of Netcat activity specifically within Linux containerized environments, where its use for listening (-l), specifying a source port (-p), executing a program (-e), or performing input/output redirection (<, >, |) often signals unauthorized access or malicious operations. While Netcat has legitimate uses for network troubleshooting, its appearance with these specific arguments inside a container is a strong indicator of compromise. This detection helps security teams identify and respond to unusual network behavior in containers, mitigating potential threats like unauthorized access, command and control, and data theft.

Impact

Successful exploitation involving malicious Netcat usage within a container can lead to significant impacts, including unauthorized remote access to the containerized application or environment, establishing persistent backdoors for continued access, and exfiltration of sensitive data. Depending on the container's privileges and network access, this could further lead to lateral movement within the host system or network, compromise of other containers, or disruption of services. While no specific victim counts or industry sectors were identified in the source, any organization leveraging Linux containers for their applications is a potential target.

Recommendation

Deploy the Sigma rules in this brief to your SIEM and tune for your environment to detect malicious Netcat activity in containers.
Review the container ID associated with alerts generated by the Netcat Listener or File Transfer Detected in Containers rule to identify the specific container and context.
Examine the process name and arguments for Netcat instances, specifically looking for arguments like -l, --listen, -p, --source-port, or -e, and redirection operators >, <, | to confirm malicious listener or file transfer activity.
Immediately isolate any affected containers to prevent further unauthorized access or data exfiltration.
Update container images and underlying host systems with the latest security patches to mitigate vulnerabilities that could be exploited by similar threats.

Detection coverage 1

Detect Netcat Listener or File Transfer in Linux Containers

medium

Detects established Netcat listeners, reverse shells, or file transfer activities using specific arguments or redirection operators within Linux containers, indicating potential malicious activity.

sigma tactics: command_and_control, execution, exfiltration techniques: T1048, T1048.003, T1059, T1059.004, T1095 sources: process_creation, linux

Detection queries are available on the platform. Get full rules →

Affected

Products

Containers

Operating systems

Linux

References

https://github.com/elastic/detection-rules/blob/main/rules/integrations/cloud_defend/execution_netcat_listener_established_inside_a_container.toml

MITRE ATT&CK

T1059 · TA0002

Command and Scripting Interpreter

Execution

high

Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence, exfiltrating data or file transfer. The rule detects command-line arguments indicating a bind shell or reverse shell to a command-line interpreter used for command execution.

T1095 · TA0011

Non-Application Layer Protocol

Command and Control

high

Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence, exfiltrating data or file transfer. The detection rule identifies suspicious Netcat activity by monitoring process events within containers, focusing on specific arguments that indicate a listening state, which is a common trait of malicious use.

T1048 · TA0010

Exfiltration Over Alternative Protocol

Exfiltration

high

Netcat is a utility used for reading and writing data across network connections, and it can be used for malicious purposes such as establishing a backdoor for persistence, exfiltrating data or file transfer. The rule detects command-line arguments indicating file transfer via stdout/pipe.