A TCP stream was created directly in a shell

Cortex Toolbox Ingest Calculator Platform Changes

Detectors ▾

All detectors Statistics ATT&CK matrix

Analytics Alerts BIOCs Correlation Rules

Content ▾

Packs Integrations MCP Servers Threat Feeds Reputation Commands

Automation

Playbooks Scripts Jobs Automation Rules Lists

Case and Issue Setup

Incident Fields Layouts Layout Rules

Threat Intelligence

Indicator Types Indicator Fields Reputation Commands Threat Feeds

Data Ingestion

Parsing Rules Modeling Rules XDRC Templates

Dashboards & Reports

XSIAM Dashboards XSIAM Reports

Docs ▾

Documentation XDM Explorer Cortex Versions

Settings ▾

Sign in

Analytics BIOC Medium

✕

A TCP stream was created directly in a shell

Attackers may create a TCP stream using the shell command line to generate a reverse shell, enabling remote access to the endpoint.

Module:: Platform Analytics
Data source:: XDR Agent

ATT&CK tactics: Execution (TA0002)

ATT&CK techniques: Command and Scripting Interpreter (T1059)

Attacker's goals:

Attackers may use this device file to create sockets though shell commands as part of a reverse shell.

Investigative actions:

Review the command line used. Search for the corresponding network event. Check the prevalence of the target IP/domain.

Test period:: N/A (single event)
Deduplication:: 1 Day