Node.js Reverse Shell Payload Delivery

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This rule detects the delivery of a Node.js reverse shell payload over HTTP. It looks for HTTP responses (flow:to_client) containing the strings "require('net')" and "connect(" (case-insensitive), which are indicative of Node.js code attempting to establish a network connection, often for a reverse shell.