Detection of Reverse Shell Activity via Shell Command-Line Arguments

Reverse shells are a primary post-exploitation technique used by attackers to gain remote command execution on compromised hosts. By redirecting a system's standard input, output, and error streams to an external network listener, attackers bypass typical ingress firewalls. This activity is frequently observed following successful vulnerability exploitation, malware execution, or manual adversary persistence.

The provided detection logic focuses on shell interpreters (sh, bash, zsh, dash) using specific device file paths (/dev/tcp, /dev/udp) or zsh-specific network modules to initiate outbound network connections. This technique is often used because it requires no external binaries, relying solely on built-in shell features to establish a command-and-control channel. Defenders should focus on identifying child processes or shell sessions that exhibit this behavior, excluding known benign local automation.

Impact

Successful reverse shell execution grants attackers an interactive command prompt on the target host. This allows for lateral movement, data exfiltration, and the execution of further payloads. If left undetected, this allows attackers to maintain long-term access, potentially leading to widespread compromise of internal networks depending on the privileges of the shell process.

Recommendation

Prioritize the deployment of behavioral detection for shell processes attempting to utilize local device files for network communication.

• Deploy the provided Sigma rule to your EDR or SIEM telemetry ingestion pipeline.
• Tune the rule by white-listing specific, verified internal automation paths that legitimately interact with internal infrastructure via /dev/tcp.
• Investigate any hits by reviewing the parent process lineage and searching for subsequent post-exploitation behavior like credential dumping or privilege escalation attempts.
• Ensure endpoint logging (Auditbeat or Elastic Defend) is configured to capture full command-line arguments to maintain visibility into these process arguments.