BIOC
Informational
✕
Reverse shell one-liner using a scripting engine
An attacker may use scripting engines to execute code from the command line to open a reverse shell.
- Module:
- Platform Analytics
- Agent event type:
- Process execution
- Category:
- Execution
- Status:
- Enabled
ATT&CK tactics: Execution (TA0002)
ATT&CK techniques: Command and Scripting Interpreter: Unix Shell (T1059.004)
Indicator:
Process action type = execution AND target process cmd = * -c *socket* , * -c */bin/bash* , * -c */bin/sh* , * -c *cmd.exe* , * -c *powershell.exe* , * -e *socket* , * -e */bin/bash* , * -e */bin/sh* , * -e *cmd.exe* , * -e *powershell.exe* , * -r *fsockopen* , * -r */bin/bash* , * -r */bin/sh* , * -r *cmd.exe* , * -r *powershell.exe* AND target process name = python , python.exe , perl , perl.exe , php , php.exe , ruby , ruby.exe , lua , lua.exe
Preventable: yes