Reverse Shell from Web Server

Description

Detects common reverse shell patterns spawned from web server processes. Attackers frequently establish reverse shells after exploiting web vulnerabilities to maintain interactive access to the compromised system. This rule looks for specific command patterns known to create reverse shells, including bash /dev/tcp redirects, netcat with -e flag, and common scripting language reverse shell idioms.

Query · falco

spawned_process and spawned_by_web_server and (proc.cmdline contains "/dev/tcp/" or
     proc.cmdline contains "nc -e" or
     proc.cmdline contains "ncat -e" or
     proc.cmdline contains "bash -i" or
     proc.cmdline contains "python -c 'import socket" or
     proc.cmdline contains "python3 -c 'import socket" or
     proc.cmdline contains "perl -e 'use Socket" or
     proc.cmdline contains "ruby -rsocket" or
     (proc.cmdline contains "mkfifo" and proc.cmdline contains "/tmp"))

Rule dependencies

Depends on

  • composes · Falco macro spawned_by_web_server
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Reverse shell spawned from web server | process=%proc.name web_server=%proc.pname evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Reverse Shell from Web Server · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Reverse Shell from Web Server
desc: 'Detects common reverse shell patterns spawned from web server processes. Attackers
  frequently establish reverse shells after exploiting web vulnerabilities to maintain
  interactive access to the compromised system. This rule looks for specific command
  patterns known to create reverse shells, including bash /dev/tcp redirects, netcat
  with -e flag, and common scripting language reverse shell idioms.

  '
condition: "spawned_process and spawned_by_web_server and (proc.cmdline contains \"\
  /dev/tcp/\" or\n     proc.cmdline contains \"nc -e\" or\n     proc.cmdline contains\
  \ \"ncat -e\" or\n     proc.cmdline contains \"bash -i\" or\n     proc.cmdline contains\
  \ \"python -c 'import socket\" or\n     proc.cmdline contains \"python3 -c 'import\
  \ socket\" or\n     proc.cmdline contains \"perl -e 'use Socket\" or\n     proc.cmdline\
  \ contains \"ruby -rsocket\" or\n     (proc.cmdline contains \"mkfifo\" and proc.cmdline\
  \ contains \"/tmp\"))\n"
output: Reverse shell spawned from web server | process=%proc.name web_server=%proc.pname
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags
priority: CRITICAL
tags:
- maturity_sandbox
- host
- container
- process
- network
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.