Python Reverse Shell Script Downloaded

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects the download of a Python script that appears to be a reverse shell. It specifically looks for HTTP traffic (flow:to_client,established) containing the strings "import socket" and "connect(" within the file data, case-insensitive. These strings are common indicators of Python code attempting to establish a network connection, often used in reverse shell implementations.