Skip to content
Threat Feed
Subscribe

Tag

Reverse-Shell

4 briefs RSS
high advisory

Komari Agent Abused as SYSTEM-Level Backdoor

Threat actors are abusing the Komari monitoring agent, a project hosted on GitHub, as a SYSTEM-level backdoor following initial access through compromised VPN credentials and lateral movement via Impacket.

Defender +2 komari backdoor nssm github rat reverse shell
2r 4t 2i
medium advisory

Potential Reverse Shell via Java on Linux

The execution of a Linux shell process from a Java JAR application following an incoming network connection may indicate reverse shell activity.

Elastic Defend reverse-shell java linux execution
2r 2t
high advisory

ESXi Host Reverse Shell Detection

This detection identifies reverse shell string patterns on an ESXi host via syslog, potentially indicating a threat actor attempting to establish remote control over the system, which may lead to further compromise such as ransomware deployment.

ESXi reverse-shell vmware syslog ransomware
3r 1t
high advisory

Potential Command Shell via NetCat Execution

The rule identifies potential attempts to execute a reverse shell using the netcat utility to execute Windows commands via Cmd.exe or Powershell.

Elastic Defend reverse shell netcat command execution windows
2r 3t