Elastic Defend high stable eql

Bind Shell via Netcat Traditional

Detects the creation of a bind shell via Netcat traditional. Attackers may spawn bind shells to establish persistence onto a target system.

View Source

Detection Logic

process where event.type == "start" and event.action == "exec" and
process.name in ("nc", "ncat", "netcat", "netcat.openbsd", "netcat.traditional", "nc.openbsd", "nc.traditional") and
process.args == "-e" and process.args : "-*l*" and process.args : "-*p*" and
process.args : "*sh*" and process.args_count >= 5

Field Validations

Loading…

Comments (0)

Loading comments...