Netcat/Socat Remote Code Execution on Host

Description

Netcat/Socat Program runs on host that allows remote code execution and may be utilized as a part of a variety of reverse shell payload https://github.com/swisskyrepo/PayloadsAllTheThings/. These programs are of higher relevance as they are commonly installed on UNIX-like operating systems.

Query · falco

spawned_process and not container and ((proc.name = "nc" and (proc.cmdline contains "-e" or
                            proc.cmdline contains "-c")) or
     (proc.name = "ncat" and (proc.args contains "--sh-exec" or
                              proc.args contains "--exec" or proc.args contains "-e " or
                              proc.args contains "-c " or proc.args contains "--lua-exec")) or
     (proc.name = 'socat' and (proc.args contains "EXEC" or
                               proc.args contains "SYSTEM")))

Rule dependencies

Depends on

  • composes · Falco macro container
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro spawned_process
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Netcat/Socat runs on host that allows remote code execution | evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty exe_flags=%evt.arg.flags

Raw source Netcat/Socat Remote Code Execution on Host · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Netcat/Socat Remote Code Execution on Host
desc: 'Netcat/Socat Program runs on host that allows remote code execution and may
  be utilized as a part of a variety of reverse shell payload https://github.com/swisskyrepo/PayloadsAllTheThings/.
  These programs are of higher relevance as they are commonly installed on UNIX-like
  operating systems.

  '
condition: "spawned_process and not container and ((proc.name = \"nc\" and (proc.cmdline\
  \ contains \"-e\" or\n                            proc.cmdline contains \"-c\"))\
  \ or\n     (proc.name = \"ncat\" and (proc.args contains \"--sh-exec\" or\n    \
  \                          proc.args contains \"--exec\" or proc.args contains \"\
  -e \" or\n                              proc.args contains \"-c \" or proc.args\
  \ contains \"--lua-exec\")) or\n     (proc.name = 'socat' and (proc.args contains\
  \ \"EXEC\" or\n                               proc.args contains \"SYSTEM\")))\n"
output: Netcat/Socat runs on host that allows remote code execution | evt_type=%evt.type
  user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name
  proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty
  exe_flags=%evt.arg.flags
priority: WARNING
tags:
- maturity_sandbox
- host
- network
- process
- mitre_execution
- T1059

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.