possible_bind_or_reverse_shell_via_netcat_auditbeat_for_linux

rule possible_bind_or_reverse_shell_via_netcat_auditbeat_for_linux {
 meta:
    author = "Roman Ranskyi"
    description = "Detects possible bind or reverse shell via \"classic\" netcat tool. For rule usage, you must be install auditbeat.  License: https://github.com/Neo23x0/sigma/blob/master/LICENSE.Detection.Rules.md."
    reference = "https://tdm.socprime.com/tdm/info/4pqSLAxPuT7R"
    version = "0.01"
    created = "2021-03-09"
    product = "linux"
    service = "auditbeat"
    mitre = "Command And Control, t1008, Execution, t1059, t1072"

  events:
(($netcat_shell.target.process.command_line = "netcat" or $netcat_shell.target.process.command_line = "nc") and (($netcat_shell.network.direction = "listening" or $netcat_shell.network.direction = "outbound" or $netcat_shell.network.direction = "outgoing") or ($netcat_shell.target.process.command_line = "-e" or $netcat_shell.target.process.command_line = "/bin/bash" or $netcat_shell.target.process.command_line = "/bin/sh" or $netcat_shell.target.process.command_line = "-nv")))

  condition:
    $netcat_shell
}