high Sigma Linux

Reverse Shell via /dev/tcp

Bash redirecting a shell to a network socket. No binary dropped, no file on disk - a common next step after web application compromise.

Rule source

linux-devtcp-reverse-shell.yml

title: Reverse Shell via /dev/tcp
id: 4a7e9c31-8b2d-4016-9f5c-3d81a6b0e2f4
status: stable
description: >
  A shell redirected to a TCP socket using bash built-in networking. No binary
  dropped, no file on disk - a common next step after web application compromise.
references:
  - https://attack.mitre.org/techniques/T1059/004/
author: DetectionOps
date: 2026/09/18
logsource:
  product: linux
  category: process_creation
  definition: 'auditd execve, Falco syscall events, or EDR process telemetry'
detection:
  selection_shell:
    Image|endswith:
      - '/bash'
      - '/sh'
      - '/zsh'
  selection_socket:
    CommandLine|contains:
      - '/dev/tcp/'
      - '/dev/udp/'
  selection_redirect:
    CommandLine|contains:
      - '>&'
      - '0<&'
      - '0>&'
  condition: all of selection_*
fields:
  - CommandLine
  - ParentImage
  - User
falsepositives:
  - Health-check scripts using /dev/tcp for port probing
  - Legacy deployment tooling without netcat available
level: high
tags:
  - attack.execution
  - attack.t1059.004

Required telemetry

auditd execve / Falco syscall events / EDR process telemetry

Confirm this source is arriving before you judge the rule. A detection built on telemetry you do not collect looks identical to one that simply never fires.

Known false positives

Health-check scripts using /dev/tcp for port probing
Legacy deployment tooling without netcat available

Validation

Atomic Red Team T1059.004-1 in a network-isolated container

Re-run quarterly. Rules decay because the environment moves underneath them - agent upgrades, schema changes and config edits all break detections silently.