UAT-11823 Netcat reverse shell post CVE-2026-20079 exploitation on FMC

Ali AlEnezi@site

•updated Sep 14, 2026•4•0•7

Detects network traffic patterns indicative of a Netcat-based reverse shell associated with the UAT-11823 (Sandworm) threat group. The rule monitors for characteristic command output such as 'uid=' and 'gid=', shell error strings containing '/bin/sh', and root shell prompts ('root@#') following suspected exploitation of CVE-2026-20079.