Windows shell banner in cleartext outbound - reverse shell
Detects outbound network traffic containing cleartext Windows command shell banners, which is highly indicative of a reverse shell connection where a remote attacker has established interactive command-line access to a compromised host.
Suricata
